# glpi. Every CVE that names glpi among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [GLPI vulnerable to exposure of sensitive information in the \`status.php\` endpoint](https://agentprime.io/advisories/CVE-2025-21626.md) `CVE-2025-21626` · CVE record: glpi-project glpi · CVSS 5.8 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: Information disclosure - [GLPI index.php redirect](https://agentprime.io/advisories/CVE-2024-11955.md) `CVE-2024-11955` · CVE record: GLPI · CVSS 5.3 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: Open redirect - [GLPI vulnerable to unauthenticated session hijacking](https://agentprime.io/advisories/CVE-2024-50339.md) `CVE-2024-50339` · CVE record: glpi-project glpi · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.19 · Not analysed yet · Published 11 Dec 2024 · Tags: Cross-site scripting (XSS), Authentication bypass - [GLPI vulnerable to authenticated insecure account deletion](https://agentprime.io/advisories/CVE-2024-48912.md) `CVE-2024-48912` · CVE record: glpi-project glpi · CVSS 7.2 High · Not analysed yet · Published 11 Dec 2024 · Tags: Broken access control - [GLPI vulnerable to account takeover via the password reset feature](https://agentprime.io/advisories/CVE-2024-47761.md) `CVE-2024-47761` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 11 Dec 2024 · Tags: Authentication bypass - [GLPI vulnerable to account takeover via API](https://agentprime.io/advisories/CVE-2024-47760.md) `CVE-2024-47760` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 11 Dec 2024 · Tags: Broken access control - [GLPI vulnerable to account takeover without privilege escalation through the API](https://agentprime.io/advisories/CVE-2024-47758.md) `CVE-2024-47758` · CVE record: glpi-project glpi · CVSS 7.6 High · Not analysed yet · Published 11 Dec 2024 · Tags: Broken access control - [GLPI vulnerable to enumeration of users' email addresses by unauthenticated user](https://agentprime.io/advisories/CVE-2024-43416.md) `CVE-2024-43416` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 18 Nov 2024 · Tags: Information disclosure - [GLPI allows API document download without rights](https://agentprime.io/advisories/CVE-2024-38370.md) `CVE-2024-38370` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Broken access control - [GLPI has a stored XSS at src/RSSFeed.php](https://agentprime.io/advisories/CVE-2024-45611.md) `CVE-2024-45611` · CVE record: glpi-project glpi · CVSS 5.7 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Cross-site scripting (XSS) - [GLPI has a reflected XSS in ajax/cable.php](https://agentprime.io/advisories/CVE-2024-45610.md) `CVE-2024-45610` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Cross-site scripting (XSS) - [GLPI has a Reflected XSS in /front/stat.graph.php](https://agentprime.io/advisories/CVE-2024-45609.md) `CVE-2024-45609` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Cross-site scripting (XSS) - [GLPI has an Authenticated SQL Injection](https://agentprime.io/advisories/CVE-2024-45608.md) `CVE-2024-45608` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: SQL injection - [GLPI has multiple reflected XSS](https://agentprime.io/advisories/CVE-2024-43418.md) `CVE-2024-43418` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Cross-site scripting (XSS) - [Reflected XSS in Software form](https://agentprime.io/advisories/CVE-2024-43417.md) `CVE-2024-43417` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Cross-site scripting (XSS) - [Authenticated SQL injection in ticket form](https://agentprime.io/advisories/CVE-2024-41679.md) `CVE-2024-41679` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: SQL injection - [GLPI has multiple reflected XSS](https://agentprime.io/advisories/CVE-2024-41678.md) `CVE-2024-41678` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Cross-site scripting (XSS) - [GLPI allows account takeover via SQL Injection in AJAX scripts](https://agentprime.io/advisories/CVE-2024-40638.md) `CVE-2024-40638` · CVE record: glpi-project glpi · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.38 · Not analysed yet · Published 15 Nov 2024 · Tags: SQL injection - [GLPI has a stored XSS via document upload](https://agentprime.io/advisories/CVE-2024-47759.md) `CVE-2024-47759` · CVE record: glpi-project glpi · CVSS 6.7 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Cross-site scripting (XSS) - [GLPI allows remote code execution through the plugin loader](https://agentprime.io/advisories/CVE-2024-37149.md) `CVE-2024-37149` · CVE record: glpi-project glpi · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 10 Jul 2024 · Tags: Path traversal - [GLPI allows account takeover via SQL Injection in AJAX scripts](https://agentprime.io/advisories/CVE-2024-37148.md) `CVE-2024-37148` · CVE record: glpi-project glpi · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 10 Jul 2024 · Tags: SQL injection - [GLPI allows Authenticated File Upload to Restricted Tickets](https://agentprime.io/advisories/CVE-2024-37147.md) `CVE-2024-37147` · CVE record: glpi-project glpi · CVSS 4.3 Medium · Not analysed yet · Published 10 Jul 2024 · Tags: Broken access control - [GLPI contains an authenticated SQL injection](https://agentprime.io/advisories/CVE-2024-31456.md) `CVE-2024-31456` · CVE record: glpi-project glpi · CVSS 7.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.59 · Not analysed yet · Published 7 May 2024 · Tags: SQL injection - [GLPI contains an SQL injection through the saved searches](https://agentprime.io/advisories/CVE-2024-29889.md) `CVE-2024-29889` · CVE record: glpi-project glpi · CVSS 7.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.65 · Not analysed yet · Published 7 May 2024 · Tags: SQL injection - [Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI](https://agentprime.io/advisories/CVE-2024-27914.md) `CVE-2024-27914` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 18 Mar 2024 · Tags: Cross-site scripting (XSS) - [Stored XSS in dashboards in GLPI](https://agentprime.io/advisories/CVE-2024-27104.md) `CVE-2024-27104` · CVE record: glpi-project glpi · CVSS 4.5 Medium · Not analysed yet · Published 18 Mar 2024 · Tags: Cross-site scripting (XSS) - [Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI](https://agentprime.io/advisories/CVE-2024-27098.md) `CVE-2024-27098` · CVE record: glpi-project glpi · CVSS 6.4 Medium · EPSS 0.36 · Not analysed yet · Published 18 Mar 2024 · Tags: Server-side request forgery (SSRF) - [SQL Injection in through the search engine](https://agentprime.io/advisories/CVE-2024-27096.md) `CVE-2024-27096` · CVE record: glpi-project glpi · CVSS 7.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.59 · Not analysed yet · Published 18 Mar 2024 · Tags: SQL injection - [Sensitive fields access through dropdowns in GLPI](https://agentprime.io/advisories/CVE-2024-27930.md) `CVE-2024-27930` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 18 Mar 2024 · Tags: Broken access control - [glpi Users emails enumeration](https://agentprime.io/advisories/CVE-2024-27937.md) `CVE-2024-27937` · CVE record: glpi-project glpi · CVSS 6.5 Medium · EPSS 0.27 · Not analysed yet · Published 18 Mar 2024 · Tags: Broken access control - [GLPI LDAP Injection during authentication](https://agentprime.io/advisories/CVE-2023-51446.md) `CVE-2023-51446` · CVE record: glpi-project glpi · CVSS 5.9 Medium · Not analysed yet · Published 1 Feb 2024 · Tags: Other injection - [GLPI reflected XSS in reports pages](https://agentprime.io/advisories/CVE-2024-23645.md) `CVE-2024-23645` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 1 Feb 2024 · Tags: Cross-site scripting (XSS) - [GLPI SQL injection through inventory agent request](https://agentprime.io/advisories/CVE-2023-46727.md) `CVE-2023-46727` · CVE record: glpi-project glpi · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.68 · Not analysed yet · Published 13 Dec 2023 · Tags: SQL injection - [GLPI Remote code execution from LDAP server configuration form on PHP 7.4](https://agentprime.io/advisories/CVE-2023-46726.md) `CVE-2023-46726` · CVE record: glpi-project glpi · CVSS 7.2 High · Not analysed yet · Published 13 Dec 2023 · Tags: Other injection - [glpi Authenticated SQL Injection](https://agentprime.io/advisories/CVE-2023-43813.md) `CVE-2023-43813` · CVE record: glpi-project glpi · CVSS 6.5 Medium · EPSS 0.31 · Not analysed yet · Published 13 Dec 2023 · Tags: SQL injection - [GLPI vulnerable to unallowed PHP script execution](https://agentprime.io/advisories/CVE-2023-42802.md) `CVE-2023-42802` · CVE record: glpi-project glpi · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2023 · Tags: CWE-20 - [File deletion through document upload process in GLPI](https://agentprime.io/advisories/CVE-2023-42462.md) `CVE-2023-42462` · CVE record: glpi-project glpi · CVSS 7.7 High · Not analysed yet · Published 26 Sept 2023 · Tags: Path traversal - [SQL injection in ITIL actors in GLPI](https://agentprime.io/advisories/CVE-2023-42461.md) `CVE-2023-42461` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2023 · Tags: SQL injection - [Phishing through a login page malicious URL in GLPI](https://agentprime.io/advisories/CVE-2023-41888.md) `CVE-2023-41888` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2023 · Tags: Path traversal - [Account takeover via Kanban feature in GLPI](https://agentprime.io/advisories/CVE-2023-41326.md) `CVE-2023-41326` · CVE record: glpi-project glpi · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.37 · Not analysed yet · Published 26 Sept 2023 · Tags: Privilege escalation - [Account takeover through API in GLPI](https://agentprime.io/advisories/CVE-2023-41324.md) `CVE-2023-41324` · CVE record: glpi-project glpi · CVSS 8.1 High · Not analysed yet · Published 26 Sept 2023 · Tags: Privilege escalation - [Users login enumeration by unauthenticated user in GLPI](https://agentprime.io/advisories/CVE-2023-41323.md) `CVE-2023-41323` · CVE record: glpi-project glpi · CVSS 5.3 Medium · EPSS 0.34 · Not analysed yet · Published 26 Sept 2023 · Tags: Information disclosure - [Privilege Escalation from technician to super-admin in GLPI](https://agentprime.io/advisories/CVE-2023-41322.md) `CVE-2023-41322` · CVE record: glpi-project glpi · CVSS 4.9 Medium · Not analysed yet · Published 26 Sept 2023 · Tags: Privilege escalation, Broken access control - [Sensitive fields enumeration through API in GLPI](https://agentprime.io/advisories/CVE-2023-41321.md) `CVE-2023-41321` · CVE record: glpi-project glpi · CVSS 4.9 Medium · Not analysed yet · Published 26 Sept 2023 · Tags: Information disclosure - [Account takeover via SQL Injection in UI layout preferences in GLPI](https://agentprime.io/advisories/CVE-2023-41320.md) `CVE-2023-41320` · CVE record: glpi-project glpi · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.36 · Not analysed yet · Published 26 Sept 2023 · Tags: SQL injection - [GLPI vulnerable to SQL injection via dashboard administration](https://agentprime.io/advisories/CVE-2023-37278.md) `CVE-2023-37278` · CVE record: glpi-project glpi · CVSS 6.8 Medium · Not analysed yet · Published 13 Jul 2023 · Tags: SQL injection - [GLPI vulnerable to SQL injection through Computer Virtual Machine information](https://agentprime.io/advisories/CVE-2023-36808.md) `CVE-2023-36808` · CVE record: glpi-project glpi · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.52 · Not analysed yet · Published 5 Jul 2023 · Tags: SQL injection - [GLPI vulnerable to unauthenticated access to Dashboard data](https://agentprime.io/advisories/CVE-2023-35940.md) `CVE-2023-35940` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 5 Jul 2023 · Tags: Broken access control, Authentication bypass - [GLPI vulnerable to unauthorized access to Dashboard data](https://agentprime.io/advisories/CVE-2023-35939.md) `CVE-2023-35939` · CVE record: glpi-project glpi · CVSS 8.1 High · Not analysed yet · Published 5 Jul 2023 · Tags: Broken access control - [GLPI vulnerable to SQL injection via inventory agent request](https://agentprime.io/advisories/CVE-2023-35924.md) `CVE-2023-35924` · CVE record: glpi-project glpi · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.52 · Not analysed yet · Published 5 Jul 2023 · Tags: SQL injection - [GLPI vulnerable to reflected XSS in search pages](https://agentprime.io/advisories/CVE-2023-34244.md) `CVE-2023-34244` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 5 Jul 2023 · Tags: Cross-site scripting (XSS) - [GLPI vulnerable to unauthorized access to KnowbaseItem data](https://agentprime.io/advisories/CVE-2023-34107.md) `CVE-2023-34107` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 5 Jul 2023 · Tags: Broken access control - [GLPI vulnerable to unauthorized access to User data](https://agentprime.io/advisories/CVE-2023-34106.md) `CVE-2023-34106` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 5 Jul 2023 · Tags: Broken access control - [GLPI vulnerable to stored Cross-site Scripting through dashboard administration](https://agentprime.io/advisories/CVE-2023-28852.md) `CVE-2023-28852` · CVE record: glpi-project glpi · CVSS 4.8 Medium · Not analysed yet · Published 5 Apr 2023 · Tags: Cross-site scripting (XSS) - [GLPI vulnerable to SQL injection and Stored XSS via inventory agent request](https://agentprime.io/advisories/CVE-2023-28849.md) `CVE-2023-28849` · CVE record: glpi-project glpi · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Apr 2023 · Tags: Cross-site scripting (XSS), SQL injection - [GLPI vulnerable to SQL injection through dynamic reports](https://agentprime.io/advisories/CVE-2023-28838.md) `CVE-2023-28838` · CVE record: glpi-project glpi · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Apr 2023 · Tags: SQL injection - [GLPI vulnerable to stored Cross-site Scripting in external links](https://agentprime.io/advisories/CVE-2023-28636.md) `CVE-2023-28636` · CVE record: glpi-project glpi · CVSS 4.5 Medium · Not analysed yet · Published 5 Apr 2023 · Tags: Cross-site scripting (XSS) - [GLPI vulnerable to Privilege Escalation from Technician to Super-Admin](https://agentprime.io/advisories/CVE-2023-28634.md) `CVE-2023-28634` · CVE record: glpi-project glpi · CVSS 8.8 High · Not analysed yet · Published 5 Apr 2023 · Tags: Broken access control - [GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feeds](https://agentprime.io/advisories/CVE-2023-28633.md) `CVE-2023-28633` · CVE record: glpi-project glpi · CVSS 3.5 Low · Not analysed yet · Published 5 Apr 2023 · Tags: Server-side request forgery (SSRF) - [GLPI vulnerable to account takeover by authenticated user](https://agentprime.io/advisories/CVE-2023-28632.md) `CVE-2023-28632` · CVE record: glpi-project glpi · CVSS 8.1 High · Not analysed yet · Published 5 Apr 2023 · Tags: Privilege escalation Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .