Advisories · Technology
glpi.
Every CVE that names glpi among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.1 Medium
GLPI vulnerable to reflected Cross-site Scripting in search pages
- glpi
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
glpi contains XSS Stored inside Standard Interface Help Link href attribute
- glpi
- Cross-site scripting (XSS)
- CVSS 7.5 High
glpi Unauthorized access to inventory files
- glpi
- Broken access control
- CVSS 6.8 Medium
glpi subject to Cross-site Scripting (XSS) - Reflected
- glpi
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
glpi contains XSS in RSS Description Link
- glpi
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
glpi vulnerable to XSS on external links
- glpi
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
glpi vulnerable to Unauthorized access to data export
- glpi
- Privilege escalation
- CVSS 2.6 Low
Improper input validation on emails links in GLPI
- glpi
- CWE-20
- CVSS 4.5 Medium
Cross-Site Scripting (XSS) through public RSS feed in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Stored Cross-Site Scripting (XSS) in entity name in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Stored Cross-Site Scripting (XSS) in user information in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 7.5 High
Stored Cross-Site Scripting (XSS) through asset inventory in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Improper access to debug panel in GLPI
- glpi
- Broken access control
- CVSS 7.4 HighCritical · CVSS 7+ and EPSS
SQL Injection on REST API in GLPI
- glpi
- SQL injection
- CVSS 4.5 Medium
Cross-Site Scripting (XSS) in external links in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning
- glpi
- Server-side request forgery (SSRF)
- CVSS 5.2 Medium
Stored Cross-Site Scripting (XSS) on login page in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
user session persists even after permanently deleting account in GLPI
- glpi
- Authentication bypass
- CVSS 6.8 Medium
Stored Cross Site Scripting (XSS) through global search in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
SQL injection through plugin controller in GLPI
- glpi
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
SQL injection in GLPI
- glpi
- SQL injection
- CVSS 3.5 Low
Blind Server-Side Request Forgery (SSRF) in GLPI
- glpi
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Cross site scripting (XSS) via registration API in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Leak of sensitive information through login page error in GLPI
- glpi
- Information disclosure
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
SQL injection on login page in GLPI
- glpi
- SQL injection
- CVSS 5.3 Medium
Sensitive Data Exposure on Refused Inventory Files in GLPI
- glpi
- Information disclosure
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL injection with _actor parameter in GLPI
- glpi
- SQL injection
- CVSS 8.1 High
SQL injection in GLPI
- glpi
- SQL injection
- CVSS 5.4 Medium
Stored cross site scrpting in GLPI's Kanban
- glpi
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Cross Site Scripting in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 7.3 High
Cross site scripting via SVG file upload in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 7.5 High
LDAP password exposure in glpi
- glpi
- Information disclosure
- CVSS 6.8 Medium
IP restriction on GLPI API Bypass with custom header injection
- glpi
- Other injection
- CVSS 5.3 Medium
Disclosure of GLPI and server information in telemetry endpoint
- glpi
- Information disclosure
- CVSS 6.5 Medium
Autologin cookie accessible by scripts
- glpi
- CWE-1004
- CVSS 8.8 High
Bypassable CSRF protection
- glpi
- Cross-site request forgery (CSRF)
-
Cross-site scripting in glpi
- glpi
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Insecure Direct Object Reference (IDOR) on "Solutions"
- glpi
- Broken access control
- CVSS 6.2 Medium
Stored XSS in budget type
- glpi
- Cross-site scripting (XSS)
- CVSS 7.7 High
Horizontal Privilege Escalation
- glpi
- Broken access control
- CVSS 6.8 Medium
Unsafe Reflection in getItemForItemtype()
- glpi
- Broken access control
- CVSS 5.4 Medium
XSS injection on ticket update
- glpi
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Stored XSS on documents
- glpi
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
XSS on tabs
- glpi
- Other injection
- CVSS 6.8 Medium
XSS injection in ajax/kanban
- glpi
- Cross-site scripting (XSS)
- CVSS 5.8 Medium
entities switch IDOR
- glpi
- Broken access control
- CVSS 7.7 High
Any GLPI CalDAV calendars is read-only for every authenticated user
- glpi
- Broken access control
- CVSS 5.0 Medium
SQL Injection in GLPI Search API
- glpi
- SQL injection
- CVSS 5.3 Medium
User data exposure in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 8.0 High
Unauthenticated Stored XSS in GLPI
- glpi
- Cross-site scripting (XSS)
- CVSS 8.7 High
SQL injection in GLPI
- glpi
- SQL injection
- CVSS 7.4 HighCritical · CVSS 7+ and EPSS
Unauthenticated File Deletion in GLPI
- glpi
- Information disclosure
- CVSS 7.8 High
Insecure encryption algorithm in GLPI
- GLPI
- Weak cryptography or TLS
- CVSS 7.1 High
SQL Injection in glpi
- glpi
- SQL injection
- CVSS 7.4 HighCritical · CVSS 7+ and EPSS
Remote Code Execution in GLPI
- GLPI
- Other injection
- CVSS 6.0 Medium
Reflexive XSS in GLPI
- GLPI
- Cross-site scripting (XSS)
- CVSS 7.2 High
Public GLPIKEY can be used to decrypt any data in GLPI
- glpi
- Hard-coded credentials
- CVSS 7.6 High
XSS in GLPI
- GLPI
- Cross-site scripting (XSS)
- CVSS 7.5 High
weak CSRF tokens in GLPI
- GLPI
- Weak cryptography or TLS
- CVSS 6.1 Medium
bypass of manageRedirect in GLPI
- GLPI
- Open redirect
- CWE-185