# glpi.

Every CVE that names glpi among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds](https://agentprime.io/advisories/CVE-2026-53631.md)
  `CVE-2026-53631` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [GLPI: Blind Time based SQLI in dropdowns](https://agentprime.io/advisories/CVE-2026-47678.md)
  `CVE-2026-47678` · CVE record: glpi-project glpi · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: SQL injection
- [GLPI: MFA bypass](https://agentprime.io/advisories/CVE-2026-52848.md)
  `CVE-2026-52848` · CVE record: glpi-project glpi · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [GLPI: Unallowed notifications sending](https://agentprime.io/advisories/CVE-2026-57152.md)
  `CVE-2026-57152` · CVE record: glpi-project glpi · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning](https://agentprime.io/advisories/CVE-2026-121559.md)
  `CVE-2026-121559` · CVE record: glpi-project GLPI · CVSS 8.6 High · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation
- [GLPI through 12.0.0 Missing Authorization via ajax/map.php](https://agentprime.io/advisories/CVE-2026-108726.md)
  `CVE-2026-108726` · CVE record: glpi-project GLPI · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [GLPI: SQL injection in history tab](https://agentprime.io/advisories/CVE-2026-53629.md)
  `CVE-2026-53629` · CVE record: glpi-project glpi · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection
- [GLPI: Arbitrary Document Read via Form Context Authorization Bypass](https://agentprime.io/advisories/CVE-2026-53626.md)
  `CVE-2026-53626` · CVE record: glpi-project glpi · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [GLPI: RCE via Form import](https://agentprime.io/advisories/CVE-2026-48482.md)
  `CVE-2026-48482` · CVE record: glpi-project glpi · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [GLPI: Privilege Escalation via authtype API manipulation](https://agentprime.io/advisories/CVE-2026-53625.md)
  `CVE-2026-53625` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [GLPI: Reflected XSS in dashboards](https://agentprime.io/advisories/CVE-2026-53610.md)
  `CVE-2026-53610` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [GLPI: arbitrary file deletion](https://agentprime.io/advisories/CVE-2026-47679.md)
  `CVE-2026-47679` · CVE record: glpi-project glpi · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [GLPI: Stored XSS in suppliers](https://agentprime.io/advisories/CVE-2026-55214.md)
  `CVE-2026-55214` · CVE record: glpi-project glpi · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-116
- [GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force](https://agentprime.io/advisories/CVE-2026-49470.md)
  `CVE-2026-49470` · CVE record: glpi-project glpi · CVSS 7.7 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [GLPI: Unallowed modfication of knowbase items comments and translations](https://agentprime.io/advisories/CVE-2026-55217.md)
  `CVE-2026-55217` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [GLPI: Unallowed authentication method update by administrator](https://agentprime.io/advisories/CVE-2026-53628.md)
  `CVE-2026-53628` · CVE record: glpi-project glpi · CVSS 5.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)](https://agentprime.io/advisories/CVE-2026-45801.md)
  `CVE-2026-45801` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation
- [GLPI: Unexpected access to update operations through the API](https://agentprime.io/advisories/CVE-2026-53627.md)
  `CVE-2026-53627` · CVE record: glpi-project glpi · CVSS 6.0 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [GLPI: LDAP filter injection in user import feature](https://agentprime.io/advisories/CVE-2026-49469.md)
  `CVE-2026-49469` · CVE record: glpi-project glpi · CVSS 4.6 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection
- [glpi-project glpi Document document.send.php canViewFile authorization](https://agentprime.io/advisories/CVE-2026-13490.md)
  `CVE-2026-13490` · CVE record: glpi-project glpi · CVSS 6.3 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Broken access control
- [GLPI has stored XSS in asset locks](https://agentprime.io/advisories/CVE-2026-42321.md)
  `CVE-2026-42321` · CVE record: glpi-project glpi · CVSS 8.4 High · Not analysed yet · Published 3 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [GLPI vulnerable to arbitrary file access](https://agentprime.io/advisories/CVE-2026-42320.md)
  `CVE-2026-42320` · CVE record: glpi-project glpi · CVSS 5.9 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Broken access control
- [GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint](https://agentprime.io/advisories/CVE-2026-42318.md)
  `CVE-2026-42318` · CVE record: glpi-project glpi · CVSS 7.0 High · Not analysed yet · Published 3 Jun 2026 · Tags: Broken access control
- [GLPI vulnerable to arbitrary files deletion by technician](https://agentprime.io/advisories/CVE-2026-42317.md)
  `CVE-2026-42317` · CVE record: glpi-project glpi · CVSS 7.0 High · Not analysed yet · Published 3 Jun 2026 · Tags: Broken access control
- [GLPI vulnerable to unauthorized reading of a specific asset object](https://agentprime.io/advisories/CVE-2026-44281.md)
  `CVE-2026-44281` · CVE record: glpi-project glpi · CVSS 7.0 High · Not analysed yet · Published 3 Jun 2026 · Tags: Broken access control
- [GLPI Vulnerable to Stored XSS in ITIL Costs](https://agentprime.io/advisories/CVE-2026-40108.md)
  `CVE-2026-40108` · CVE record: glpi-project glpi · CVSS 7.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: Cross-site scripting (XSS)
- [GLPI 11.0.0 - Stored XSS in knowledge base](https://agentprime.io/advisories/CVE-2026-5385.md)
  `CVE-2026-5385` · CVE record: glpi-project glpi · CVSS 8.4 High · Not analysed yet · Published 2 Jun 2026 · Tags: Cross-site scripting (XSS)
- [GLPI: Unauthorized export of form structure](https://agentprime.io/advisories/CVE-2026-32312.md)
  `CVE-2026-32312` · CVE record: glpi-project glpi · CVSS 5.1 Medium · Not analysed yet · Published 18 May 2026 · Tags: Broken access control
- [GLPI has an Authenticated SQL Injection via log exports](https://agentprime.io/advisories/CVE-2026-29047.md)
  `CVE-2026-29047` · CVE record: glpi-project glpi · CVSS 7.2 High · Not analysed yet · Published 6 Apr 2026 · Tags: SQL injection
- [GLPI has an Unauthenticated SQL Injection via Search engine](https://agentprime.io/advisories/CVE-2026-26263.md)
  `CVE-2026-26263` · CVE record: glpi-project glpi · CVSS 8.1 High · Not analysed yet · Published 6 Apr 2026 · Tags: SQL injection
- [GLPI has an Unauthenticated Stored XSS via inventory](https://agentprime.io/advisories/CVE-2026-26027.md)
  `CVE-2026-26027` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Authentication bypass, CWE-116
- [GLPI has a Server-Side Template Injection via Double-Compilation](https://agentprime.io/advisories/CVE-2026-26026.md)
  `CVE-2026-26026` · CVE record: glpi-project glpi · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 6 Apr 2026 · Tags: Code injection
- [GLPI has Stored XSS in Supplier 'Website' field](https://agentprime.io/advisories/CVE-2026-25932.md)
  `CVE-2026-25932` · CVE record: glpi-project glpi · CVSS 7.2 High · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [GLPI has a MFA bypass](https://agentprime.io/advisories/CVE-2026-25937.md)
  `CVE-2026-25937` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: Authentication bypass
- [GLPI Vulnerable to Authenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-25936.md)
  `CVE-2026-25936` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: SQL injection
- [GLPI affected by Remote Code Execution via malicious upload](https://agentprime.io/advisories/CVE-2026-22248.md)
  `CVE-2026-22248` · CVE record: glpi-project glpi · CVSS 8.1 High · Not analysed yet · Published 11 Mar 2026 · Tags: Insecure deserialization
- [GLPI is Vulnerable to Authenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-22044.md)
  `CVE-2026-22044` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: SQL injection
- [GLPI is vulnerable to session stealing on externally authenticated user change](https://agentprime.io/advisories/CVE-2026-23624.md)
  `CVE-2026-23624` · CVE record: glpi-project glpi · CVSS 4.3 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Authentication bypass
- [GLPI is Vulnerable to SSRF via Webhooks](https://agentprime.io/advisories/CVE-2026-22247.md)
  `CVE-2026-22247` · CVE record: glpi-project glpi · CVSS 4.1 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [GLPI has an unauthenticated SQL injection through the inventory endpoint](https://agentprime.io/advisories/CVE-2025-66417.md)
  `CVE-2025-66417` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 15 Jan 2026 · Tags: SQL injection
- [GLPI incorrectly authorizes access to documents](https://agentprime.io/advisories/CVE-2025-64516.md)
  `CVE-2025-64516` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 15 Jan 2026 · Tags: Broken access control
- [GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint](https://agentprime.io/advisories/CVE-2023-53943.md)
  `CVE-2023-53943` · CVE record: Glpi-Project GLPI · CVSS 6.9 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Information disclosure
- [GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API](https://agentprime.io/advisories/CVE-2025-64520.md)
  `CVE-2025-64520` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Broken access control
- [GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page](https://agentprime.io/advisories/CVE-2025-59935.md)
  `CVE-2025-59935` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Cross-site scripting (XSS)
- [GLPI permits unauthorized rules execution order](https://agentprime.io/advisories/CVE-2025-53105.md)
  `CVE-2025-53105` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2025 · Tags: Privilege escalation
- [GLPI permits reservation modification by unauthorized users](https://agentprime.io/advisories/CVE-2025-53357.md)
  `CVE-2025-53357` · CVE record: glpi-project glpi · CVSS 5.4 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Broken access control
- [GLPI technicians can access unauthorized information through external links](https://agentprime.io/advisories/CVE-2025-53113.md)
  `CVE-2025-53113` · CVE record: glpi-project glpi · CVSS 2.7 Low · Not analysed yet · Published 30 Jul 2025 · Tags: Broken access control
- [GLPI's incomprehensive permission checks can lead to data removal from allowed users](https://agentprime.io/advisories/CVE-2025-53112.md)
  `CVE-2025-53112` · CVE record: glpi-project glpi · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Broken access control
- [GLPI exposes data to non-allowed users](https://agentprime.io/advisories/CVE-2025-53111.md)
  `CVE-2025-53111` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Broken access control
- [GLPI's MailCollector Receiver is vulnerable to credential exfiltration](https://agentprime.io/advisories/CVE-2025-53008.md)
  `CVE-2025-53008` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Hard-coded credentials
- [GLPI is vulnerable to XSS and open redirection attacks through planning feature](https://agentprime.io/advisories/CVE-2025-52897.md)
  `CVE-2025-52897` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Cross-site scripting (XSS), Open redirect
- [GLPI has overly permissive URL verification](https://agentprime.io/advisories/CVE-2025-52567.md)
  `CVE-2025-52567` · CVE record: glpi-project glpi · CVSS 3.5 Low · Not analysed yet · Published 30 Jul 2025 · Tags: Server-side request forgery (SSRF)
- [GLPI is susceptible to Stored XSS attack through project's kanban](https://agentprime.io/advisories/CVE-2025-27514.md)
  `CVE-2025-27514` · CVE record: glpi-project glpi · CVSS 4.5 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: Cross-site scripting (XSS)
- [GLPI allows authenticated remote code execution](https://agentprime.io/advisories/CVE-2025-24801.md)
  `CVE-2025-24801` · CVE record: glpi-project glpi · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 18 Mar 2025 · Tags: Unrestricted file upload
- [GLPI allows unauthenticated SQL injection through the inventory endpoint](https://agentprime.io/advisories/CVE-2025-24799.md)
  `CVE-2025-24799` · CVE record: glpi-project glpi · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.87 · Not analysed yet · Published 18 Mar 2025 · Tags: SQL injection
- [GLPI allows SQL injection through the rules configuration](https://agentprime.io/advisories/CVE-2025-21619.md)
  `CVE-2025-21619` · CVE record: glpi-project glpi · CVSS 8.2 High · Not analysed yet · Published 18 Mar 2025 · Tags: SQL injection
- [GLPI allows unauthorized access to debug mode](https://agentprime.io/advisories/CVE-2025-25192.md)
  `CVE-2025-25192` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: Information disclosure
- [GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin](https://agentprime.io/advisories/CVE-2025-23046.md)
  `CVE-2025-23046` · CVE record: glpi-project glpi · CVSS 6.3 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: Authentication bypass
- [GLPI: Plugins are disabled accessing one page](https://agentprime.io/advisories/CVE-2025-23024.md)
  `CVE-2025-23024` · CVE record: glpi-project glpi · CVSS 6.9 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: Broken access control
- [GLPI Cross-site Scripting vulnerability](https://agentprime.io/advisories/CVE-2025-21627.md)
  `CVE-2025-21627` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: Cross-site scripting (XSS)

Older: <https://agentprime.io/advisories/technology/glpi.md?cursor=WyIyMDI1LTAyLTI1VDE1OjQzOjM0LjkxOTAwMFoiLCJDVkUtMjAyNS0yMTYyNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=glpi>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/glpi/>. Everything for agents: <https://agentprime.io/llms.txt>.