CVE-2024-40638

8.8 highEPSS 38%

High (8.8) in glpi-project glpi. EPSS 38% chance of exploitation in the next 30 days.

GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 38% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2024-11-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

glpi-project:glpi

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-8843-r3m7-gfqx

Check your stack JSON