/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
https://glpi-project.org/fr/glpi-10-0-3-disponible/
https://github.com/glpi-project/glpi/releases
http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html