CVE-2026-11321

Name of the Vulnerable Software and Affected Versions DataInjection plugin for GLPI version 2.15.6

Description An authenticated user with access to the data injection feature can perform a time-based blind SQL injection. This occurs because the plugin concatenates user-supplied CSV field values directly into SQL queries during the CSV import process without using parameterization or escaping. An attacker can embed SQL expressions, such as SLEEP(), within a mapped field like Serial Number to manipulate the query and extract sensitive database information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.