The GLPI Inventory Plugin allows users to view network inventories and generate reports. Prior to version 1.6.6, unsanitized input from a user‑controlled dropdown in the calendar report can be exploited for an SQL injection. An attacker with sufficient rights could execute arbitrary SQL commands against the underlying database, potentially reading, modifying, or deleting inventory data and compromising the confidentiality and integrity of the system. The vulnerability does not provide a direct code‑execution path but can be used to subvert data integrity.

This flaw affects the GLPI Inventory Plugin, used with GLPI for asset management. Versions prior to 1.6.6 are vulnerable; upgrade to 1.6.6 or newer to eliminate the issue.

The CVSS score of 7.1 indicates a high impact, and an EPSS score below 1 % suggests a low likelihood of widespread exploitation, consistent with the absence from the KEV catalog. The attack requires an authenticated user with report‑generation privileges who can supply crafted input to the dropdown. When these conditions are met, the injection can be executed; the exploit path is straightforward through the web interface.