GLPI versions 10.x.x suffers from a remote command execution vulnerability via the shell commands plugin.