An unauthenticated time‑based blind SQL injection exists in the search engine of GLPI versions 11.0.0 through 11.0.5. The flaw allows an unauthenticated attacker to inject SQL into search parameters, causing the database to execute an injected query. Successful exploitation can read arbitrary data from the database, thereby compromising confidentiality of assets, users, and configuration information.

GLPI, a free asset and IT management software package developed by the GLPI Project, is affected. All versions from 11.0.0 up to but not including 11.0.6 are vulnerable. No other vendors or product variants have been reported as impacted.

The CVSS v3 score of 8.1 indicates a high severity impact. The EPSS score is below 1%, suggesting that active exploitation is unlikely at this time. This vulnerability is not listed in the CISA KEV catalog, further indicating limited live exploitation. The attack vector is most likely the public search interface, requiring no user authentication or elevated privileges. Overall, the risk is high due to the ease of exploitation for any user, but the likelihood of exploitation remains low.