Advisories · Technology

glpi.

Every CVE that names glpi among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-21626 CVE record

CVSS 5.8 Medium

GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint
- glpi
- Information disclosure
Not analysed yet 25 Feb 2025
CVE-2024-11955 CVE record

CVSS 5.3 Medium

GLPI index.php redirect
- GLPI
- Open redirect
Not analysed yet 25 Feb 2025
CVE-2024-50339 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

GLPI vulnerable to unauthenticated session hijacking
- glpi
- Cross-site scripting (XSS)
- Authentication bypass
Not analysed yet 11 Dec 2024
CVE-2024-48912 CVE record

CVSS 7.2 High

GLPI vulnerable to authenticated insecure account deletion
- glpi
- Broken access control
Not analysed yet 11 Dec 2024
CVE-2024-47761 CVE record

CVSS 7.5 High

GLPI vulnerable to account takeover via the password reset feature
- glpi
- Authentication bypass
Not analysed yet 11 Dec 2024
CVE-2024-47760 CVE record

CVSS 7.5 High

GLPI vulnerable to account takeover via API
- glpi
- Broken access control
Not analysed yet 11 Dec 2024
CVE-2024-47758 CVE record

CVSS 7.6 High

GLPI vulnerable to account takeover without privilege escalation through the API
- glpi
- Broken access control
Not analysed yet 11 Dec 2024
CVE-2024-43416 CVE record

CVSS 7.5 High

GLPI vulnerable to enumeration of users' email addresses by unauthenticated user
- glpi
- Information disclosure
Not analysed yet 18 Nov 2024
CVE-2024-38370 CVE record

CVSS 5.3 Medium

GLPI allows API document download without rights
- glpi
- Broken access control
Not analysed yet 15 Nov 2024
CVE-2024-45611 CVE record

CVSS 5.7 Medium

GLPI has a stored XSS at src/RSSFeed.php
- glpi
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2024
CVE-2024-45610 CVE record

CVSS 6.5 Medium

GLPI has a reflected XSS in ajax/cable.php
- glpi
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2024
CVE-2024-45609 CVE record

CVSS 6.5 Medium

GLPI has a Reflected XSS in /front/stat.graph.php
- glpi
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2024
CVE-2024-45608 CVE record

CVSS 6.5 Medium

GLPI has an Authenticated SQL Injection
- glpi
- SQL injection
Not analysed yet 15 Nov 2024
CVE-2024-43418 CVE record

CVSS 6.5 Medium

GLPI has multiple reflected XSS
- glpi
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2024
CVE-2024-43417 CVE record

CVSS 6.5 Medium

Reflected XSS in Software form
- glpi
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2024
CVE-2024-41679 CVE record

CVSS 6.5 Medium

Authenticated SQL injection in ticket form
- glpi
- SQL injection
Not analysed yet 15 Nov 2024
CVE-2024-41678 CVE record

CVSS 6.5 Medium

GLPI has multiple reflected XSS
- glpi
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2024
CVE-2024-40638 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

GLPI allows account takeover via SQL Injection in AJAX scripts
- glpi
- SQL injection
Not analysed yet 15 Nov 2024
CVE-2024-47759 CVE record

CVSS 6.7 Medium

GLPI has a stored XSS via document upload
- glpi
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2024
CVE-2024-37149 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

GLPI allows remote code execution through the plugin loader
- glpi
- Path traversal
Not analysed yet 10 Jul 2024
CVE-2024-37148 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

GLPI allows account takeover via SQL Injection in AJAX scripts
- glpi
- SQL injection
Not analysed yet 10 Jul 2024
CVE-2024-37147 CVE record

CVSS 4.3 Medium

GLPI allows Authenticated File Upload to Restricted Tickets
- glpi
- Broken access control
Not analysed yet 10 Jul 2024
CVE-2024-31456 CVE record

CVSS 7.7 HighCritical · CVSS 7+ and EPSS

GLPI contains an authenticated SQL injection
- glpi
- SQL injection
Not analysed yet 7 May 2024
CVE-2024-29889 CVE record

CVSS 7.1 HighCritical · CVSS 7+ and EPSS

GLPI contains an SQL injection through the saved searches
- glpi
- SQL injection
Not analysed yet 7 May 2024
CVE-2024-27914 CVE record

CVSS 5.3 Medium

Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI
- glpi
- Cross-site scripting (XSS)
Not analysed yet 18 Mar 2024
CVE-2024-27104 CVE record

CVSS 4.5 Medium

Stored XSS in dashboards in GLPI
- glpi
- Cross-site scripting (XSS)
Not analysed yet 18 Mar 2024
CVE-2024-27098 CVE record

CVSS 6.4 Medium

Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI
- glpi
- Server-side request forgery (SSRF)
Not analysed yet 18 Mar 2024
CVE-2024-27096 CVE record

CVSS 7.7 HighCritical · CVSS 7+ and EPSS

SQL Injection in through the search engine
- glpi
- SQL injection
Not analysed yet 18 Mar 2024
CVE-2024-27930 CVE record

CVSS 6.5 Medium

Sensitive fields access through dropdowns in GLPI
- glpi
- Broken access control
Not analysed yet 18 Mar 2024
CVE-2024-27937 CVE record

CVSS 6.5 Medium

glpi Users emails enumeration
- glpi
- Broken access control
Not analysed yet 18 Mar 2024
CVE-2023-51446 CVE record

CVSS 5.9 Medium

GLPI LDAP Injection during authentication
- glpi
- Other injection
Not analysed yet 1 Feb 2024
CVE-2024-23645 CVE record

CVSS 6.5 Medium

GLPI reflected XSS in reports pages
- glpi
- Cross-site scripting (XSS)
Not analysed yet 1 Feb 2024
CVE-2023-46727 CVE record

CVSS 8.6 HighCritical · CVSS 7+ and EPSS

GLPI SQL injection through inventory agent request
- glpi
- SQL injection
Not analysed yet 13 Dec 2023
CVE-2023-46726 CVE record

CVSS 7.2 High

GLPI Remote code execution from LDAP server configuration form on PHP 7.4
- glpi
- Other injection
Not analysed yet 13 Dec 2023
CVE-2023-43813 CVE record

CVSS 6.5 Medium

glpi Authenticated SQL Injection
- glpi
- SQL injection
Not analysed yet 13 Dec 2023
CVE-2023-42802 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

GLPI vulnerable to unallowed PHP script execution
- glpi
- CWE-20
Not analysed yet 2 Nov 2023
CVE-2023-42462 CVE record

CVSS 7.7 High

File deletion through document upload process in GLPI
- glpi
- Path traversal
Not analysed yet 26 Sept 2023
CVE-2023-42461 CVE record

CVSS 6.5 Medium

SQL injection in ITIL actors in GLPI
- glpi
- SQL injection
Not analysed yet 26 Sept 2023
CVE-2023-41888 CVE record

CVSS 5.3 Medium

Phishing through a login page malicious URL in GLPI
- glpi
- Path traversal
Not analysed yet 26 Sept 2023
CVE-2023-41326 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

Account takeover via Kanban feature in GLPI
- glpi
- Privilege escalation
Not analysed yet 26 Sept 2023
CVE-2023-41324 CVE record

CVSS 8.1 High

Account takeover through API in GLPI
- glpi
- Privilege escalation
Not analysed yet 26 Sept 2023
CVE-2023-41323 CVE record

CVSS 5.3 Medium

Users login enumeration by unauthenticated user in GLPI
- glpi
- Information disclosure
Not analysed yet 26 Sept 2023
CVE-2023-41322 CVE record

CVSS 4.9 Medium

Privilege Escalation from technician to super-admin in GLPI
- glpi
- Privilege escalation
- Broken access control
Not analysed yet 26 Sept 2023
CVE-2023-41321 CVE record

CVSS 4.9 Medium

Sensitive fields enumeration through API in GLPI
- glpi
- Information disclosure
Not analysed yet 26 Sept 2023
CVE-2023-41320 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

Account takeover via SQL Injection in UI layout preferences in GLPI
- glpi
- SQL injection
Not analysed yet 26 Sept 2023
CVE-2023-37278 CVE record

CVSS 6.8 Medium

GLPI vulnerable to SQL injection via dashboard administration
- glpi
- SQL injection
Not analysed yet 13 Jul 2023
CVE-2023-36808 CVE record

CVSS 8.6 HighCritical · CVSS 7+ and EPSS

GLPI vulnerable to SQL injection through Computer Virtual Machine information
- glpi
- SQL injection
Not analysed yet 5 Jul 2023
CVE-2023-35940 CVE record

CVSS 7.5 High

GLPI vulnerable to unauthenticated access to Dashboard data
- glpi
- Broken access control
- Authentication bypass
Not analysed yet 5 Jul 2023
CVE-2023-35939 CVE record

CVSS 8.1 High

GLPI vulnerable to unauthorized access to Dashboard data
- glpi
- Broken access control
Not analysed yet 5 Jul 2023
CVE-2023-35924 CVE record

CVSS 8.6 HighCritical · CVSS 7+ and EPSS

GLPI vulnerable to SQL injection via inventory agent request
- glpi
- SQL injection
Not analysed yet 5 Jul 2023
CVE-2023-34244 CVE record

CVSS 6.5 Medium

GLPI vulnerable to reflected XSS in search pages
- glpi
- Cross-site scripting (XSS)
Not analysed yet 5 Jul 2023
CVE-2023-34107 CVE record

CVSS 6.5 Medium

GLPI vulnerable to unauthorized access to KnowbaseItem data
- glpi
- Broken access control
Not analysed yet 5 Jul 2023
CVE-2023-34106 CVE record

CVSS 6.5 Medium

GLPI vulnerable to unauthorized access to User data
- glpi
- Broken access control
Not analysed yet 5 Jul 2023
CVE-2023-28852 CVE record

CVSS 4.8 Medium

GLPI vulnerable to stored Cross-site Scripting through dashboard administration
- glpi
- Cross-site scripting (XSS)
Not analysed yet 5 Apr 2023
CVE-2023-28849 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

GLPI vulnerable to SQL injection and Stored XSS via inventory agent request
- glpi
- Cross-site scripting (XSS)
- SQL injection
Not analysed yet 5 Apr 2023
CVE-2023-28838 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

GLPI vulnerable to SQL injection through dynamic reports
- glpi
- SQL injection
Not analysed yet 5 Apr 2023
CVE-2023-28636 CVE record

CVSS 4.5 Medium

GLPI vulnerable to stored Cross-site Scripting in external links
- glpi
- Cross-site scripting (XSS)
Not analysed yet 5 Apr 2023
CVE-2023-28634 CVE record

CVSS 8.8 High

GLPI vulnerable to Privilege Escalation from Technician to Super-Admin
- glpi
- Broken access control
Not analysed yet 5 Apr 2023
CVE-2023-28633 CVE record

CVSS 3.5 Low

GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feeds
- glpi
- Server-side request forgery (SSRF)
Not analysed yet 5 Apr 2023
CVE-2023-28632 CVE record

CVSS 8.1 High

GLPI vulnerable to account takeover by authenticated user
- glpi
- Privilege escalation
Not analysed yet 5 Apr 2023