# glpi.

Every CVE that names glpi among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [GLPI vulnerable to reflected Cross-site Scripting in search pages](https://agentprime.io/advisories/CVE-2023-28639.md)
  `CVE-2023-28639` · CVE record: glpi glpi · CVSS 6.1 Medium · Not analysed yet · Published 5 Apr 2023 · Tags: Cross-site scripting (XSS)
- [glpi contains XSS Stored inside Standard Interface Help Link href attribute](https://agentprime.io/advisories/CVE-2022-41941.md)
  `CVE-2022-41941` · CVE record: glpi-project glpi · CVSS 6.2 Medium · Not analysed yet · Published 25 Jan 2023 · Tags: Cross-site scripting (XSS)
- [glpi Unauthorized access to inventory files](https://agentprime.io/advisories/CVE-2023-22500.md)
  `CVE-2023-22500` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 25 Jan 2023 · Tags: Broken access control
- [glpi subject to Cross-site Scripting (XSS) - Reflected](https://agentprime.io/advisories/CVE-2023-22722.md)
  `CVE-2023-22722` · CVE record: glpi-project glpi · CVSS 6.8 Medium · Not analysed yet · Published 25 Jan 2023 · Tags: Cross-site scripting (XSS)
- [glpi contains XSS in RSS Description Link](https://agentprime.io/advisories/CVE-2023-22724.md)
  `CVE-2023-22724` · CVE record: glpi-project glpi · CVSS 6.2 Medium · Not analysed yet · Published 25 Jan 2023 · Tags: Cross-site scripting (XSS)
- [glpi vulnerable to XSS on external links](https://agentprime.io/advisories/CVE-2023-22725.md)
  `CVE-2023-22725` · CVE record: glpi-project glpi · CVSS 6.2 Medium · Not analysed yet · Published 25 Jan 2023 · Tags: Cross-site scripting (XSS)
- [glpi vulnerable to Unauthorized access to data export](https://agentprime.io/advisories/CVE-2023-23610.md)
  `CVE-2023-23610` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 25 Jan 2023 · Tags: Privilege escalation
- [Improper input validation on emails links in GLPI](https://agentprime.io/advisories/CVE-2022-39376.md)
  `CVE-2022-39376` · CVE record: glpi-project glpi · CVSS 2.6 Low · Not analysed yet · Published 3 Nov 2022 · Tags: CWE-20
- [Cross-Site Scripting (XSS) through public RSS feed in GLPI](https://agentprime.io/advisories/CVE-2022-39375.md)
  `CVE-2022-39375` · CVE record: glpi-project glpi · CVSS 4.5 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) in entity name in GLPI](https://agentprime.io/advisories/CVE-2022-39373.md)
  `CVE-2022-39373` · CVE record: glpi-project glpi · CVSS 4.9 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) in user information in GLPI](https://agentprime.io/advisories/CVE-2022-39372.md)
  `CVE-2022-39372` · CVE record: glpi-project glpi · CVSS 3.5 Low · Not analysed yet · Published 3 Nov 2022 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) through asset inventory in GLPI](https://agentprime.io/advisories/CVE-2022-39371.md)
  `CVE-2022-39371` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 3 Nov 2022 · Tags: Cross-site scripting (XSS)
- [Improper access to debug panel in GLPI](https://agentprime.io/advisories/CVE-2022-39370.md)
  `CVE-2022-39370` · CVE record: glpi-project glpi · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: Broken access control
- [SQL Injection on REST API in GLPI](https://agentprime.io/advisories/CVE-2022-39323.md)
  `CVE-2022-39323` · CVE record: glpi-project glpi · CVSS 7.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.37 · Not analysed yet · Published 3 Nov 2022 · Tags: SQL injection
- [Cross-Site Scripting (XSS) in external links in GLPI](https://agentprime.io/advisories/CVE-2022-39277.md)
  `CVE-2022-39277` · CVE record: glpi-project glpi · CVSS 4.5 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: Cross-site scripting (XSS)
- [Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning](https://agentprime.io/advisories/CVE-2022-39276.md)
  `CVE-2022-39276` · CVE record: glpi-project glpi · CVSS 3.5 Low · Not analysed yet · Published 3 Nov 2022 · Tags: Server-side request forgery (SSRF)
- [Stored Cross-Site Scripting (XSS) on login page in GLPI](https://agentprime.io/advisories/CVE-2022-39262.md)
  `CVE-2022-39262` · CVE record: glpi-project glpi · CVSS 5.2 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: Cross-site scripting (XSS)
- [user session persists even after permanently deleting account in GLPI](https://agentprime.io/advisories/CVE-2022-39234.md)
  `CVE-2022-39234` · CVE record: glpi-project glpi · CVSS 4.7 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: Authentication bypass
- [Stored Cross Site Scripting (XSS) through global search in GLPI](https://agentprime.io/advisories/CVE-2022-31187.md)
  `CVE-2022-31187` · CVE record: glpi-project glpi · CVSS 6.8 Medium · Not analysed yet · Published 14 Sept 2022 · Tags: Cross-site scripting (XSS)
- [SQL injection through plugin controller in GLPI](https://agentprime.io/advisories/CVE-2022-35946.md)
  `CVE-2022-35946` · CVE record: glpi-project glpi · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2022 · Tags: SQL injection
- [SQL injection in GLPI](https://agentprime.io/advisories/CVE-2022-35947.md)
  `CVE-2022-35947` · CVE record: glpi-project glpi · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2022 · Tags: SQL injection
- [Blind Server-Side Request Forgery (SSRF) in GLPI](https://agentprime.io/advisories/CVE-2022-36112.md)
  `CVE-2022-36112` · CVE record: glpi-project glpi · CVSS 3.5 Low · Not analysed yet · Published 14 Sept 2022 · Tags: Server-side request forgery (SSRF)
- [Cross site scripting (XSS) via registration API in GLPI](https://agentprime.io/advisories/CVE-2022-35945.md)
  `CVE-2022-35945` · CVE record: glpi-project glpi · CVSS 6.3 Medium · Not analysed yet · Published 14 Sept 2022 · Tags: Cross-site scripting (XSS)
- [Leak of sensitive information through login page error in GLPI](https://agentprime.io/advisories/CVE-2022-31143.md)
  `CVE-2022-31143` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2022 · Tags: Information disclosure
- [SQL injection on login page in GLPI](https://agentprime.io/advisories/CVE-2022-31061.md)
  `CVE-2022-31061` · CVE record: glpi-project glpi · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.51 · Not analysed yet · Published 28 Jun 2022 · Tags: SQL injection
- [Sensitive Data Exposure on Refused Inventory Files in GLPI](https://agentprime.io/advisories/CVE-2022-31068.md)
  `CVE-2022-31068` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 28 Jun 2022 · Tags: Information disclosure
- [SQL injection with \_actor parameter in GLPI](https://agentprime.io/advisories/CVE-2022-31056.md)
  `CVE-2022-31056` · CVE record: glpi-project glpi · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jun 2022 · Tags: SQL injection
- [SQL injection in GLPI](https://agentprime.io/advisories/CVE-2022-29250.md)
  `CVE-2022-29250` · CVE record: glpi-project glpi · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2022 · Tags: SQL injection
- [Stored cross site scrpting in GLPI's Kanban](https://agentprime.io/advisories/CVE-2022-24876.md)
  `CVE-2022-24876` · CVE record: glpi-project glpi · CVSS 5.4 Medium · Not analysed yet · Published 9 Jun 2022 · Tags: Cross-site scripting (XSS)
- [Cross Site Scripting in GLPI](https://agentprime.io/advisories/CVE-2022-24869.md)
  `CVE-2022-24869` · CVE record: glpi-project glpi · CVSS 4.6 Medium · Not analysed yet · Published 21 Apr 2022 · Tags: Cross-site scripting (XSS)
- [Cross site scripting via SVG file upload in GLPI](https://agentprime.io/advisories/CVE-2022-24868.md)
  `CVE-2022-24868` · CVE record: glpi-project glpi · CVSS 7.3 High · Not analysed yet · Published 21 Apr 2022 · Tags: Cross-site scripting (XSS)
- [LDAP password exposure in glpi](https://agentprime.io/advisories/CVE-2022-24867.md)
  `CVE-2022-24867` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2022 · Tags: Information disclosure
- [IP restriction on GLPI API Bypass with custom header injection](https://agentprime.io/advisories/CVE-2021-39213.md)
  `CVE-2021-39213` · CVE record: glpi-project glpi · CVSS 6.8 Medium · Not analysed yet · Published 15 Sept 2021 · Tags: Other injection
- [Disclosure of GLPI and server information in telemetry endpoint](https://agentprime.io/advisories/CVE-2021-39211.md)
  `CVE-2021-39211` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2021 · Tags: Information disclosure
- [Autologin cookie accessible by scripts](https://agentprime.io/advisories/CVE-2021-39210.md)
  `CVE-2021-39210` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2021 · Tags: CWE-1004
- [Bypassable CSRF protection](https://agentprime.io/advisories/CVE-2021-39209.md)
  `CVE-2021-39209` · CVE record: glpi-project glpi · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2021 · Tags: Cross-site request forgery (CSRF)
- [Cross-site scripting in glpi](https://agentprime.io/advisories/CVE-2021-3486.md)
  `CVE-2021-3486` · CVE record: glpi · No CVSS score · Not analysed yet · Published 26 May 2021 · Tags: Cross-site scripting (XSS)
- [Insecure Direct Object Reference (IDOR) on "Solutions"](https://agentprime.io/advisories/CVE-2021-21324.md)
  `CVE-2021-21324` · CVE record: glpi-project glpi · CVSS 6.8 Medium · Not analysed yet · Published 8 Mar 2021 · Tags: Broken access control
- [Stored XSS in budget type](https://agentprime.io/advisories/CVE-2021-21325.md)
  `CVE-2021-21325` · CVE record: glpi-project glpi · CVSS 6.2 Medium · Not analysed yet · Published 8 Mar 2021 · Tags: Cross-site scripting (XSS)
- [Horizontal Privilege Escalation](https://agentprime.io/advisories/CVE-2021-21326.md)
  `CVE-2021-21326` · CVE record: glpi-project glpi · CVSS 7.7 High · Not analysed yet · Published 8 Mar 2021 · Tags: Broken access control
- [Unsafe Reflection in getItemForItemtype()](https://agentprime.io/advisories/CVE-2021-21327.md)
  `CVE-2021-21327` · CVE record: glpi-project glpi · CVSS 6.8 Medium · Not analysed yet · Published 8 Mar 2021 · Tags: Broken access control
- [XSS injection on ticket update](https://agentprime.io/advisories/CVE-2021-21314.md)
  `CVE-2021-21314` · CVE record: glpi-project glpi · CVSS 5.4 Medium · Not analysed yet · Published 3 Mar 2021 · Tags: Cross-site scripting (XSS)
- [Stored XSS on documents](https://agentprime.io/advisories/CVE-2021-21312.md)
  `CVE-2021-21312` · CVE record: glpi-project glpi · CVSS 5.4 Medium · Not analysed yet · Published 3 Mar 2021 · Tags: Cross-site scripting (XSS)
- [XSS on tabs](https://agentprime.io/advisories/CVE-2021-21313.md)
  `CVE-2021-21313` · CVE record: glpi-project glpi · CVSS 4.9 Medium · Not analysed yet · Published 3 Mar 2021 · Tags: Other injection
- [XSS injection in ajax/kanban](https://agentprime.io/advisories/CVE-2021-21258.md)
  `CVE-2021-21258` · CVE record: glpi-project glpi · CVSS 6.8 Medium · Not analysed yet · Published 2 Mar 2021 · Tags: Cross-site scripting (XSS)
- [entities switch IDOR](https://agentprime.io/advisories/CVE-2021-21255.md)
  `CVE-2021-21255` · CVE record: glpi-project glpi · CVSS 5.8 Medium · Not analysed yet · Published 2 Mar 2021 · Tags: Broken access control
- [Any GLPI CalDAV calendars is read-only for every authenticated user](https://agentprime.io/advisories/CVE-2020-26212.md)
  `CVE-2020-26212` · CVE record: glpi-project glpi · CVSS 7.7 High · Not analysed yet · Published 25 Nov 2020 · Tags: Broken access control
- [SQL Injection in GLPI Search API](https://agentprime.io/advisories/CVE-2020-15226.md)
  `CVE-2020-15226` · CVE record: glpi-project glpi · CVSS 5.0 Medium · Not analysed yet · Published 7 Oct 2020 · Tags: SQL injection
- [User data exposure in GLPI](https://agentprime.io/advisories/CVE-2020-15217.md)
  `CVE-2020-15217` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2020 · Tags: Cross-site scripting (XSS)
- [Unauthenticated Stored XSS in GLPI](https://agentprime.io/advisories/CVE-2020-15177.md)
  `CVE-2020-15177` · CVE record: glpi-project glpi · CVSS 8.0 High · Not analysed yet · Published 7 Oct 2020 · Tags: Cross-site scripting (XSS)
- [SQL injection in GLPI](https://agentprime.io/advisories/CVE-2020-15176.md)
  `CVE-2020-15176` · CVE record: glpi-project glpi · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2020 · Tags: SQL injection
- [Unauthenticated File Deletion in GLPI](https://agentprime.io/advisories/CVE-2020-15175.md)
  `CVE-2020-15175` · CVE record: glpi-project glpi · CVSS 7.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.70 · Not analysed yet · Published 7 Oct 2020 · Tags: Information disclosure
- [Insecure encryption algorithm in GLPI](https://agentprime.io/advisories/CVE-2020-11031.md)
  `CVE-2020-11031` · CVE record: glpi-project GLPI · CVSS 7.8 High · Not analysed yet · Published 23 Sept 2020 · Tags: Weak cryptography or TLS
- [SQL Injection in glpi](https://agentprime.io/advisories/CVE-2020-15108.md)
  `CVE-2020-15108` · CVE record: glpi-project glpi · CVSS 7.1 High · Not analysed yet · Published 17 Jul 2020 · Tags: SQL injection
- [Remote Code Execution in GLPI](https://agentprime.io/advisories/CVE-2020-11060.md)
  `CVE-2020-11060` · CVE record: glpi-project GLPI · CVSS 7.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 12 May 2020 · Tags: Other injection
- [Reflexive XSS in GLPI](https://agentprime.io/advisories/CVE-2020-11062.md)
  `CVE-2020-11062` · CVE record: GLPI GLPI · CVSS 6.0 Medium · Not analysed yet · Published 12 May 2020 · Tags: Cross-site scripting (XSS)
- [Public GLPIKEY can be used to decrypt any data in GLPI](https://agentprime.io/advisories/CVE-2020-5248.md)
  `CVE-2020-5248` · CVE record: glpi-project glpi · CVSS 7.2 High · Not analysed yet · Published 12 May 2020 · Tags: Hard-coded credentials
- [XSS in GLPI](https://agentprime.io/advisories/CVE-2020-11036.md)
  `CVE-2020-11036` · CVE record: glpi-project GLPI · CVSS 7.6 High · Not analysed yet · Published 5 May 2020 · Tags: Cross-site scripting (XSS)
- [weak CSRF tokens in GLPI](https://agentprime.io/advisories/CVE-2020-11035.md)
  `CVE-2020-11035` · CVE record: glpi-project GLPI · CVSS 7.5 High · Not analysed yet · Published 5 May 2020 · Tags: Weak cryptography or TLS
- [bypass of manageRedirect in GLPI](https://agentprime.io/advisories/CVE-2020-11034.md)
  `CVE-2020-11034` · CVE record: glpi-project GLPI · CVSS 6.1 Medium · Not analysed yet · Published 5 May 2020 · Tags: Open redirect, CWE-185

Newest: <https://agentprime.io/advisories/technology/glpi.md>
Older: <https://agentprime.io/advisories/technology/glpi.md?cursor=WyIyMDIwLTA1LTA1VDIxOjIwOjEyLjAwMDAwMFoiLCJDVkUtMjAyMC0xMTAzNCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=glpi&cursor=WyIyMDIzLTA0LTA1VDE0OjQ1OjEyLjA3NTAwMFoiLCJDVkUtMjAyMy0yODYzMiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/glpi/?cursor=WyIyMDIzLTA0LTA1VDE0OjQ1OjEyLjA3NTAwMFoiLCJDVkUtMjAyMy0yODYzMiJd>. Everything for agents: <https://agentprime.io/llms.txt>.