← CVE Radar
CVE-2022-35914Teclib GLPI Remote Code Execution Vulnerability
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
9.8 CRITICALEPSS 99.85%⚡ Known Exploited (CISA KEV)NVD: Published
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2022-35914
- Status
- Published
- Assigner (CNA)
- mitre
- Published
- Sep 19, 2022
- Last modified
- 2025-10-21 23:15 UTC
- Weaknesses
Affected Products
No affected products have been published for this CVE yet.
References
- bioinformatics.org http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed
- github.com https://github.com/glpi-project/glpi/releases
- glpi-project.org https://glpi-project.org/fr/glpi-10-0-3-disponible/
- packetstormsecurity.com http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html
- github.com https://github.com/Orange-Cyberdefense/CVE-repository/
- github.com https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh
- mayfly277.github.io https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/
Sources
- NVD (unavailable at last refresh)
- CVE.org
- CISA KEV
- FIRST EPSS