CRITICAL🇵🇱 Wersja polska

CVE-2026-23489

CVSS 9.1v3.1pub. 2026-03-16upd. 2026-03-18

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Teclib Edition Fields

    APP
    Teclib-Edition
    < 1.23.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2019-12723CRITICAL9.8ten sam produkt

An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via contai...

CVE-2023-28855MEDIUM6.5ten sam produkt

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 a...

CVE-2021-43779CRITICAL9.9ten sam vendor

GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing...

CVE-2019-10232CRITICAL9.8ten sam vendor

Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.

CVE-2019-10231CRITICAL9.8ten sam vendor

Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication....