CVE-2019-12723

9.8 criticalEPSS 2.0%

Critical (9.8) in teclib-edition fields. EPSS 2.0% chance of exploitation in the next 30 days.

An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2019-07-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

teclib-edition:fields

References

https://github.com/pluginsGLPI/fields/blob/master/ajax/reorder.php
https://github.com/pluginsGLPI/fields/pull/317
https://github.com/pluginsGLPI/fields/releases/tag/1.10.0
https://github.com/pluginsGLPI/fields/blob/master/ajax/reorder.php
https://github.com/pluginsGLPI/fields/pull/317

Check your stack JSON