CVE-2021-21327 recently found in GLPI by Iterasec allows remote PHP objects instantiation Technical writeup and exploit included for research purposes: https://iterasec.com/cve-2021-21327-unsafe-reflection-in-getitemforitemtype-in-glpi/