The vulnerability is a classic SQL injection (CWE-89) that can be leveraged by an attacker who already possesses valid GLPI user credentials. By injecting malicious SQL commands, the attacker can modify or read sensitive data stored in GLPI’s database, potentially impacting confidentiality, integrity, and availability of the asset management system. The CVE description notes that the flaw allows arbitrary SQL execution, which may lead to data exfiltration or unauthorized configuration changes.

The affected product is GLPI from glpi-project. Versions 11.0.0 up to and including 11.0.5 are impacted. The issue is fixed in GLPI 11.0.6. The Common Platform Enumeration indicates the product as cpe:2.3:a:teclib-edition:glpi:*:*:*:*:*:*:*:*.

The CVSS score is 6.5, indicating a medium severity. EPSS is reported as less than 1%, implying a low estimated current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers need authenticated access to the GLPI instance; an attacker who can obtain or compromise user credentials can exploit the flaw. No remote unauthenticated attack vector is described, so mitigation focuses on preventing credential compromise and applying the patch.