Deserialization in Pluginsglpi Databaseinventory
CVE-2025-65035
pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions (database write access must first be obtained through another vulnerability or misconfiguration), user-controlled data is stored insecurely in the database via computergroup, and is later unserialized on every page load, allowing arbitrary PHP object instantiation. Version 1.1.2 fixes the issue.
Vulnerability class: Insecure Deserialization
EPSS: 0.003 (18.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Pluginsglpi Databaseinventory — versions < 1.1.2
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-65035?
- CVE-2025-65035 is a medium-severity vulnerability in Pluginsglpi Databaseinventory, classified under Deserialization of Untrusted Data. CVSS score: 6.4/10. Published 2025-12-19.
- How severe is CVE-2025-65035?
- Medium severity. CVSS v3 base score is 6.4 out of 10.