GLPI, a free asset and IT management software package, contains an unauthenticated time‑based blind SQL injection in its search engine for versions 11.0.0 through 11.0.5. The flaw, governed by CWE‑89, allows any unauthenticated visitor to craft a search query that is directly incorporated into an SQL statement, causing the database to execute injected logic and potentially expose arbitrary data. Exfiltration of sensitive asset, user, and configuration information compromises confidentiality and may enable further attacks.

The vulnerability affects GLPI versions 11.0.0 to 11.0.5, inclusive. No other editions or vendors have affected product besides the GLPI project package available from the official website.

The CVSS v3 score of 8.1 signals high severity. An EPSS score of 9% indicates that exploitation is moderately likely compared to other CVEs. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed active exploits in the wild have been reported. The attack requires only unauthenticated access to the public search interface, with no special permissions; the risk is high and the likelihood of exploitation is significant, especially for exposed instances.