Loading story…
GLPI, the open-source IT asset and service management platform, patched two high-severity vulnerabilities in version 11.0.6. The first, CVE-2026-26263, is an unauthenticated time-based blind SQL injection in the product's Search engine that affects versions 11.0.0 through before 11.0.6. The flaw is classified as CWE-89 and could expose or alter sensitive data and impact availability.
The same release also fixes CVE-2026-26026, a server-side template injection issue caused by double compilation that affects the same version range. That flaw, mapped to CWE-94 and CWE-1336, allows an administrator to trigger template injection that can lead to remote code execution. Both issues were disclosed through GitHub security advisories, and organizations running GLPI 11.0.0 to 11.0.5 should upgrade to 11.0.6 to remediate the vulnerabilities.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Two new GLPI vulnerabilities were recorded and published with GitHub security advisory references: CVE-2026-26026, associated with CWE-94 and CWE-1336, and CVE-2026-26263, associated with CWE-89. Both entries describe impact on GLPI versions 11.0.0 through before 11.0.6.
GLPI released version 11.0.6 to fix two vulnerabilities affecting versions 11.0.0 through before 11.0.6: CVE-2026-26026, a server-side template injection that can lead to remote code execution by an administrator, and CVE-2026-26263, an unauthenticated time-based blind SQL injection in the Search engine.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab disclosed and remediated three high-severity vulnerabilities in GitLab CE/EE that could be exploited by unauthenticated attackers under certain conditions. **CVE-2026-4922** is a cross-site request forgery flaw (`CWE-352`) that could let an attacker trigger GraphQL mutations as an authenticated user, while **CVE-2026-5262** is a cross-site scripting issue (`CWE-79`) that could expose tokens in the Storybook development environment. GitLab also fixed **CVE-2026-5816**, an improper path validation flaw (`CWE-41`) that could allow arbitrary JavaScript execution in a victim’s browser session. The issues affect multiple GitLab CE/EE release lines, with patched versions identified as **18.9.6**, **18.10.4**, and **18.11.1** depending on the flaw. CVE-2026-4922 affects versions from `17.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; CVE-2026-5262 affects versions from `16.1.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; and CVE-2026-5816 affects `18.10` before `18.10.4` and `18.11` before `18.11.1`. The vulnerabilities carry CVSS v3.1 ratings reflecting high confidentiality and integrity impact, and GitLab linked the disclosures to its patch release notice, internal work items, and HackerOne reports.
Jun 29, 2026
CERT Polska disclosed three vulnerabilities in **LMS (LAN Management System)**, including two high-severity issues tracked as `CVE-2026-40455` and `CVE-2026-40456`. The first is an authenticated SQL injection in `tarifflist.php` before commit `4cb30a7`, caused by insufficient sanitization of the POST `tg[]` parameter and unsafe query construction with `implode()`, allowing attackers to extract sensitive database information. The second is an OS command injection before commit `9fcb4de`, where an IP address parameter is passed to `exec()` without proper validation, enabling arbitrary operating system command execution. CERT Polska also reported `CVE-2026-40457`, a reflected XSS flaw in `dbrecover.php` and `netremap.php` before commit `9c5651b` that can trigger arbitrary JavaScript execution when an authenticated user opens a crafted link under certain conditions. The SQL injection and command injection bugs were both rated **High** with CVSS 4.0 base scores of **8.6**, and the disclosure credited **Tymoteusz Dominik** for responsibly reporting the issues. Organizations running LMS versions prior to the referenced commits should prioritize patching and review exposure of authenticated administrative functions.
Jun 29, 2026
WeGIA, a web management platform for charitable institutions, was found to contain two SQL-related vulnerabilities that could let attackers manipulate or fully compromise backend databases. **CVE-2026-33134** affects version `3.6.5` and earlier in `/html/matPat/restaurar_produto.php`, where the `id_produto` parameter is incorporated into SQL queries without proper sanitization, enabling authenticated time-based blind SQL injection and arbitrary SQL command execution. The flaw carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N` and was fixed in version `3.6.6`. A second flaw, **CVE-2026-33133**, affects versions `3.6.5` and `3.6.6` in the `loadBackupDB()` function, which imports SQL files from uploaded backup archives without validating their contents. A privileged attacker can submit a crafted backup archive containing malicious SQL to create rogue administrator accounts, reset passwords, or perform other unauthorized database operations. The issue is tracked as `CWE-89`, was introduced in commit `370104c`, and was patched in WeGIA version `3.6.7`.
Jun 29, 2026