Back to CVE Browser

CVE-2022-35914

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2022-09-19

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Affected Platforms (CPE)

📦

Glpi Project

Glpi

<= 10.0.2

References & Advisories

🔗 http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html

🔗 http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed

🔗 https://github.com/Orange-Cyberdefense/CVE-repository/

🔗 https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh

🔗 https://github.com/glpi-project/glpi/releases

🔗 https://glpi-project.org/fr/glpi-10-0-3-disponible/

🔗 https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/

🔗 http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html

Related Vulnerabilities

CVE-2026-113216.4

The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries du...

CVE-2026-539876.4

The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup...

CVE-2026-134903.7

A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewF...

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an aut...