glpi-project glpi
173 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-108726 | ≤ 12.0.0 | GLPI through 12.0.0 Missing Authorization via ajax/map.php | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-53629 | >= 9.4.0, < 10.0.26 ; >= 11.0.0, < 11.0.8 | GLPI: SQL injection in history tab | HIGH 7.1 | 1.0 % | ||
| CVE-2026-53626 | >= 11.0.5, < 11.0.8 | GLPI: Arbitrary Document Read via Form Context Authorization Bypass | HIGH 7.1 | 0.3 % | ||
| CVE-2026-48482 | >= 11.0.0, < 11.0.8 | GLPI: RCE via Form import | CRITICAL 9.4 | 0.3 % | ||
| CVE-2026-53625 | >= 0.70, < 10.0.26 ; >= 11.0.0, < 11.0.8 | GLPI: Privilege Escalation via authtype API manipulation | HIGH 7.5 | 0.6 % | ||
| CVE-2026-53610 | >= 11.0.0, < 11.0.8 | GLPI: Reflected XSS in dashboards | HIGH 7.5 | 0.4 % | ||
| CVE-2026-47679 | >= 10.0.0, < 10.0.26 ; >= 11.0.0, < 11.0.8 | GLPI: arbitrary file deletion | HIGH 8.5 | 0.3 % | ||
| CVE-2026-55214 | >= 11.0.6, < 11.0.8 | GLPI: Stored XSS in suppliers | HIGH 8.5 | 0.3 % | ||
| CVE-2026-49470 | >= 11.0.0, < 11.0.8 | GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force | HIGH 7.7 | 0.4 % | ||
| CVE-2026-55217 | >= 0.85, < 10.0.26 ; >= 11.0.0, < 11.0.8 | GLPI: Unallowed modfication of knowbase items comments and translations | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-53628 | >= 0.84, < 10.0.26 ; >= 11.0.0, < 11.0.8 | GLPI: Unallowed authentication method update by administrator | MEDIUM 5.9 | 0.5 % | ||
| CVE-2026-45801 | >= 0.72, < 10.0.26 ; >= 11.0.0, < 11.0.8 | GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-53627 | >= 11.0.0, < 11.0.8 | GLPI: Unexpected access to update operations through the API | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-49469 | >= 0.70, < 10.0.26 ; >= 11.0.0, < 11.0.8 | GLPI: LDAP filter injection in user import feature | MEDIUM 4.6 | 0.4 % | ||
| CVE-2026-13490 | 11.0.5 ; 11.0.6 ; 11.0.7 | glpi-project glpi Document document.send.php canViewFile authorization | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-42321 | >= 10.0.4, < 10.0.25 | GLPI has stored XSS in asset locks | HIGH 8.4 | 0.3 % | ||
| CVE-2026-42320 | >= 11.0.0, < 11.0.7 ; >= 0.50, < 10.0.25 | GLPI vulnerable to arbitrary file access | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-42318 | >= 11.0.0, < 11.0.7 ; >= 9.5.0, < 10.0.25 | GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint | HIGH 7.0 | 0.3 % | ||
| CVE-2026-42317 | >= 11.0.0, < 11.0.7 ; >= 0.78, < 10.0.25 | GLPI vulnerable to arbitrary files deletion by technician | HIGH 7.0 | 0.3 % | ||
| CVE-2026-44281 | >= 11.0.0, < 11.0.7 ; >= 0.78, < 10.0.25 | GLPI vulnerable to unauthorized reading of a specific asset object | HIGH 7.0 | 0.3 % | ||
| CVE-2026-40108 | >= 11.0.0, < 11.0.7 | GLPI Vulnerable to Stored XSS in ITIL Costs | HIGH 7.1 | 0.3 % | ||
| CVE-2026-5385 | < 11.0.7 | GLPI 11.0.0 - Stored XSS in knowledge base | HIGH 8.4 | 0.4 % | ||
| CVE-2026-32312 | >= 11.0.0, < 11.0.7 | GLPI: Unauthorized export of form structure | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-29047 | >= 10.0.0, 10.0.24 ; >= 11.0.0-alpha, < 11.0.6 | GLPI has an Authenticated SQL Injection via log exports | HIGH 8.8 | 0.4 % | ||
| CVE-2026-26263 | >= 11.0.0, < 11.0.6 | GLPI has an Unauthenticated SQL Injection via Search engine | CRITICAL 9.8 | 8.3 % | ||
| CVE-2026-26027 | >= 11.0.0, < 11.0.6 | GLPI has an Unauthenticated Stored XSS via inventory | HIGH 7.5 | 0.2 % | ||
| CVE-2026-26026 | >= 11.0.0, < 11.0.6 | GLPI has a Server-Side Template Injection via Double-Compilation | CRITICAL 9.1 | 12 % | ||
| CVE-2026-25932 | >= 0.60, < 10.0.24 | GLPI has Stored XSS in Supplier 'Website' field | HIGH 7.2 | 0.3 % | ||
| CVE-2026-25937 | >= 11.0.0, < 11.0.6 | GLPI has a MFA bypass | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-25936 | >= 11.0.0, < 11.0.6 | GLPI Vulnerable to Authenticated SQL Injection | HIGH 8.8 | 0.4 % | ||
| CVE-2026-22248 | >= 11.0.0, < 11.0.5 | GLPI affected by Remote Code Execution via malicious upload | HIGH 8.8 | 0.3 % | ||
| CVE-2026-22044 | >= 0.85, < 10.0.23 | GLPI is Vulnerable to Authenticated SQL Injection | HIGH 8.8 | 0.3 % | ||
| CVE-2026-23624 | >= 0.71, < 10.0.23 ; >= 11.0.0-alpha, < 11.0.5 | GLPI is vulnerable to session stealing on externally authenticated user change | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-22247 | >= 11.0.0, < 11.0.5 | GLPI is Vulnerable to SSRF via Webhooks | CRITICAL 9.1 | 0.4 % | ||
| CVE-2025-66417 | >= 11.0.0, < 11.0.3 | GLPI has an unauthenticated SQL injection through the inventory endpoint | CRITICAL 9.8 | 0.5 % | ||
| CVE-2025-64516 | >= 10.0.0, < 10.0.21 ; >= 11.0.0, < 11.0.3 | GLPI incorrectly authorizes access to documents | HIGH 7.5 | 0.3 % | ||
| CVE-2023-53943 | 9.5.7 | GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint | MEDIUM 6.9 | 0.4 % | ||
| CVE-2025-64520 | >= 9.1.0, < 10.0.21 | GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-59935 | >= 10.0.0, < 10.0.21 | GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-53105 | >= 10.0.0, < 10.0.19 | GLPI permits unauthorized rules execution order | HIGH 7.5 | 0.4 % | ||
| CVE-2025-53357 | >= 0.78, < 10.0.19 | GLPI permits reservation modification by unauthorized users | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-53113 | >= 0.65, < 10.0.19 | GLPI technicians can access unauthorized information through external links | LOW 2.7 | 0.3 % | ||
| CVE-2025-53112 | >= 9.1.0, < 10.0.19 | GLPI's incomprehensive permission checks can lead to data removal from allowed users | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-53111 | >= 0.80, < 10.0.19 | GLPI exposes data to non-allowed users | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-53008 | >= 9.3.1, < 10.0.19 | GLPI's MailCollector Receiver is vulnerable to credential exfiltration | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-52897 | >= 9.1.0, < 10.0.19 | GLPI is vulnerable to XSS and open redirection attacks through planning feature | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-52567 | >= 0.84, < 10.0.19 | GLPI has overly permissive URL verification | MEDIUM 5.0 | 0.2 % | ||
| CVE-2025-27514 | >= 9.5.0, < 10.0.19 | GLPI is susceptible to Stored XSS attack through project's kanban | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-24801 | >= 0.85, < 10.0.18 | GLPI allows authenticated remote code execution | HIGH 8.8 | 21 % | ||
| CVE-2025-24799 | >= 10.0.0, < 10.0.18 | GLPI allows unauthenticated SQL injection through the inventory endpoint | CRITICAL 9.8 | 87 % | ||
| CVE-2025-21619 | >= 0.78, < 10.0.18 | GLPI allows SQL injection through the rules configuration | HIGH 8.2 | 0.4 % | ||
| CVE-2025-25192 | < 10.0.18 | GLPI allows unauthorized access to debug mode | MEDIUM 6.5 | 0.7 % | ||
| CVE-2025-23046 | >= 9.5.0, < 10.0.18 | GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin | MEDIUM 6.3 | 0.5 % | ||
| CVE-2025-23024 | >= 0.72, < 10.0.18 | GLPI: Plugins are disabled accessing one page | MEDIUM 6.9 | 0.3 % | ||
| CVE-2025-21627 | < 10.0.18 | GLPI Cross-site Scripting vulnerability | MEDIUM 6.5 | 0.4 % | ||
| CVE-2025-21626 | >= 0.71, < 10.0.18 | GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-50339 | >= 9.5.0, < 10.0.17 | GLPI vulnerable to unauthenticated session hijacking | CRITICAL 9.3 | 19 % | ||
| CVE-2024-48912 | >= 10.0.0, < 10.0.17 | GLPI vulnerable to authenticated insecure account deletion | HIGH 7.2 | 0.4 % | ||
| CVE-2024-47761 | >= 0.80, < 10.0.17 | GLPI vulnerable to account takeover via the password reset feature | HIGH 7.5 | 0.5 % | ||
| CVE-2024-47760 | >= 9.1.0, < 10.0.17 | GLPI vulnerable to account takeover via API | HIGH 7.5 | 0.5 % | ||
| CVE-2024-47758 | >= 9.3.0, < 10.0.17 | GLPI vulnerable to account takeover without privilege escalation through the API | HIGH 7.6 | 0.5 % | ||
| CVE-2024-43416 | >= 0.80, < 10.0.17 | GLPI vulnerable to enumeration of users' email addresses by unauthenticated user | HIGH 7.5 | 1.2 % | ||
| CVE-2024-38370 | >= 9.2.0, < 10.0.16 | GLPI allows API document download without rights | HIGH 7.5 | 0.4 % | ||
| CVE-2024-45611 | >= 0.84, < 10.0.17 | GLPI has a stored XSS at src/RSSFeed.php | MEDIUM 5.7 | 0.3 % | ||
| CVE-2024-45610 | >= 10.0.0, < 10.0.17 | GLPI has a reflected XSS in ajax/cable.php | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-45609 | >= 0.70, < 10.0.17 | GLPI has a Reflected XSS in /front/stat.graph.php | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-45608 | >= 9.5.0, < 10.0.17 | GLPI has an Authenticated SQL Injection | HIGH 8.8 | 0.5 % | ||
| CVE-2024-43418 | >= 0.65, < 10.0.17 | GLPI has multiple reflected XSS | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-43417 | >= 10.0.0, < 10.0.17 | Reflected XSS in Software form | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-41679 | >= 10.0.0, < 10.0.17 | Authenticated SQL injection in ticket form | HIGH 8.8 | 0.5 % | ||
| CVE-2024-41678 | >= 0.50, < 10.0.17 | GLPI has multiple reflected XSS | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-40638 | >= 0.85, < 10.0.17 | GLPI allows account takeover via SQL Injection in AJAX scripts | HIGH 8.8 | 38 % | ||
| CVE-2024-47759 | >= 9.2.0, < 10.0.17 | GLPI has a stored XSS via document upload | MEDIUM 6.7 | 0.5 % | ||
| CVE-2024-37149 | >= 0.85, < 10.0.16 | GLPI allows remote code execution through the plugin loader | HIGH 8.8 | 21 % | ||
| CVE-2024-37148 | >= 0.84, < 10.0.16 | GLPI allows account takeover via SQL Injection in AJAX scripts | HIGH 8.1 | 20 % | ||
| CVE-2024-37147 | >= 0.85, < 10.0.16 | GLPI allows Authenticated File Upload to Restricted Tickets | MEDIUM 4.3 | 0.7 % | ||
| CVE-2024-31456 | < 10.0.15 | GLPI contains an authenticated SQL injection | HIGH 7.7 | 59 % | ||
| CVE-2024-29889 | < 10.0.15 | GLPI contains an SQL injection through the saved searches | HIGH 8.1 | 65 % | ||
| CVE-2024-27914 | >= 10.0.8, < 10.0.13 | Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI | MEDIUM 6.1 | 0.8 % | ||
| CVE-2024-27104 | >= 9.5.0, < 10.0.13 | Stored XSS in dashboards in GLPI | MEDIUM 4.8 | 0.7 % | ||
| CVE-2024-27098 | >= 9.5.0, < 10.0.13 | Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI | CRITICAL 9.6 | 36 % | ||
| CVE-2024-27096 | >= 0.65, < 10.0.13 | SQL Injection in through the search engine | HIGH 7.7 | 59 % | ||
| CVE-2024-27930 | >= 0.78, < 10.0.13 | Sensitive fields access through dropdowns in GLPI | MEDIUM 6.5 | 1.1 % | ||
| CVE-2024-27937 | >= 10.0.0, < 10.0.13 | glpi Users emails enumeration | MEDIUM 6.5 | 27 % | ||
| CVE-2023-51446 | >= 0.70, < 10.0.12 | GLPI LDAP Injection during authentication | HIGH 8.1 | 0.9 % | ||
| CVE-2024-23645 | >= 0.65, < 10.0.12 | GLPI reflected XSS in reports pages | MEDIUM 6.5 | 0.9 % | ||
| CVE-2023-46727 | >= 10.0.0, < 10.0.11 | GLPI SQL injection through inventory agent request | CRITICAL 9.8 | 68 % | ||
| CVE-2023-46726 | >= 10.0.0, < 10.0.11 | GLPI Remote code execution from LDAP server configuration form on PHP 7.4 | CRITICAL 9.8 | 1.3 % | ||
| CVE-2023-43813 | >= 10.0.0, < 10.0.11 | glpi Authenticated SQL Injection | HIGH 8.8 | 31 % | ||
| CVE-2023-42802 | >= 10.0.7, < 10.0.10 | GLPI vulnerable to unallowed PHP script execution | CRITICAL 10.0 | 1.1 % | ||
| CVE-2023-42462 | >= 10.0.0, < 10.0.10 | File deletion through document upload process in GLPI | CRITICAL 9.1 | 1.3 % | ||
| CVE-2023-42461 | >= 10.0.0, < 10.0.10 | SQL injection in ITIL actors in GLPI | CRITICAL 9.8 | 1.2 % | ||
| CVE-2023-41888 | >= 10.0.8, < 10.0.10 | Phishing through a login page malicious URL in GLPI | MEDIUM 5.4 | 0.5 % | ||
| CVE-2023-41326 | >= 9.5.0, < 10.0.10 | Account takeover via Kanban feature in GLPI | HIGH 8.8 | 37 % | ||
| CVE-2023-41324 | >= 9.3.0, < 10.0.10 | Account takeover through API in GLPI | HIGH 8.8 | 0.9 % | ||
| CVE-2023-41323 | >= 0.68, < 10.0.10 | Users login enumeration by unauthenticated user in GLPI | MEDIUM 5.3 | 34 % | ||
| CVE-2023-41322 | >= 9.1.0, < 10.0.10 | Privilege Escalation from technician to super-admin in GLPI | HIGH 8.8 | 0.9 % | ||
| CVE-2023-41321 | >= 9.1.1, < 10.0.10 | Sensitive fields enumeration through API in GLPI | MEDIUM 6.5 | 0.9 % | ||
| CVE-2023-41320 | >= 10.0.0, < 10.0.10 | Account takeover via SQL Injection in UI layout preferences in GLPI | CRITICAL 9.8 | 36 % | ||
| CVE-2023-37278 | >= 9.5.0, < 10.0.9 | GLPI vulnerable to SQL injection via dashboard administration | CRITICAL 9.1 | 0.7 % | ||
| CVE-2023-36808 | >= 0.80, < 10.0.8 | GLPI vulnerable to SQL injection through Computer Virtual Machine information | CRITICAL 9.8 | 52 % | ||
| CVE-2023-35940 | >= 9.5.0, < 10.0.8 | GLPI vulnerable to unauthenticated access to Dashboard data | HIGH 7.5 | 0.7 % | ||
| CVE-2023-35939 | >= 9.5.0, < 10.0.8 | GLPI vulnerable to unauthorized access to Dashboard data | HIGH 8.1 | 0.6 % | ||
| CVE-2023-35924 | >= 10.0.0, < 10.0.8 | GLPI vulnerable to SQL injection via inventory agent request | CRITICAL 9.8 | 52 % | ||
| CVE-2023-34244 | >= 9.4.0, < 10.0.8 | GLPI vulnerable to reflected XSS in search pages | MEDIUM 6.5 | 0.5 % | ||
| CVE-2023-34107 | >= 9.2.0, < 10.0.8 | GLPI vulnerable to unauthorized access to KnowbaseItem data | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-34106 | >= 0.68, < 10.0.8 | GLPI vulnerable to unauthorized access to User data | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-28852 | >= 9.5.0, < 9.5.13 ; >= 10.0.0, < 10.0.7 | GLPI vulnerable to stored Cross-site Scripting through dashboard administration | MEDIUM 4.8 | 0.5 % | ||
| CVE-2023-28849 | >= 10.0.0, < 10.0.7 | GLPI vulnerable to SQL injection and Stored XSS via inventory agent request | CRITICAL 10.0 | 0.5 % | ||
| CVE-2023-28838 | >= 0.50, < 9.5.13 ; >= 10.0.0, < 10.0.7 | GLPI vulnerable to SQL injection through dynamic reports | CRITICAL 9.6 | 0.8 % | ||
| CVE-2023-28636 | >= 0.60, < 9.5.13 ; >= 10.0.0, < 10.0.7 | GLPI vulnerable to stored Cross-site Scripting in external links | MEDIUM 4.8 | 0.6 % | ||
| CVE-2023-28634 | >= 0.83, < 9.5.13 ; >= 10.0.0, < 10.0.7 | GLPI vulnerable to Privilege Escalation from Technician to Super-Admin | HIGH 8.8 | 0.8 % | ||
| CVE-2023-28633 | >= 0.84, < 9.5.13 ; >= 10.0.0, < 10.0.7 | GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feeds | MEDIUM 5.4 | 0.5 % | ||
| CVE-2023-28632 | >= 0.83, < 9.5.13 ; >= 10.0.0, < 10.0.7 | GLPI vulnerable to account takeover by authenticated user | HIGH 8.1 | 0.7 % | ||
| CVE-2022-41941 | >= 10.0.0, 10.0.6 | glpi contains XSS Stored inside Standard Interface Help Link href attribute | MEDIUM 6.2 | 0.6 % | ||
| CVE-2023-22500 | >= 10.0.0, < 10.0.6 | glpi Unauthorized access to inventory files | HIGH 7.5 | 0.9 % | ||
| CVE-2023-22722 | >= 9.4.0, < 10.0.6 | glpi subject to Cross-site Scripting (XSS) - Reflected | MEDIUM 6.8 | 0.6 % | ||
| CVE-2023-22724 | < 10.0.6 | glpi contains XSS in RSS Description Link | MEDIUM 6.2 | 0.6 % | ||
| CVE-2023-22725 | >=0.60, < 10.0.6 | glpi vulnerable to XSS on external links | MEDIUM 6.2 | 0.6 % | ||
| CVE-2023-23610 | >= 0.65, < 9.5.12 ; >= 10.0.0, < 10.0.6 | glpi vulnerable to Unauthorized access to data export | MEDIUM 6.5 | 0.7 % | ||
| CVE-2022-39376 | >= 0.65, < 10.0.4 | Improper input validation on emails links in GLPI | MEDIUM 6.5 | 0.6 % | ||
| CVE-2022-39375 | >= 0.84, < 10.0.4 | Cross-Site Scripting (XSS) through public RSS feed in GLPI | MEDIUM 5.4 | 0.6 % | ||
| CVE-2022-39373 | >= 10.0.0, < 10.0.4 | Stored Cross-Site Scripting (XSS) in entity name in GLPI | MEDIUM 4.9 | 0.5 % | ||
| CVE-2022-39372 | >= 0.70, < 10.0.4 | Stored Cross-Site Scripting (XSS) in user information in GLPI | MEDIUM 5.4 | 0.5 % | ||
| CVE-2022-39371 | >= 10.0.0, < 10.0.4 | Stored Cross-Site Scripting (XSS) through asset inventory in GLPI | HIGH 7.5 | 0.5 % | ||
| CVE-2022-39370 | >= 0.70, < 10.0.4 | Improper access to debug panel in GLPI | MEDIUM 4.3 | 0.5 % | ||
| CVE-2022-39323 | < 10.0.4 | SQL Injection on REST API in GLPI | CRITICAL 9.8 | 37 % | ||
| CVE-2022-39277 | >= 0.60, < 10.0.4 | Cross-Site Scripting (XSS) in external links in GLPI | MEDIUM 4.8 | 0.7 % | ||
| CVE-2022-39276 | < 10.0.4 | Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning | MEDIUM 5.3 | 0.8 % | ||
| CVE-2022-39262 | < 10.0.4 | Stored Cross-Site Scripting (XSS) on login page in GLPI | MEDIUM 5.2 | 0.8 % | ||
| CVE-2022-39234 | < 10.0.4 | user session persists even after permanently deleting account in GLPI | HIGH 8.8 | 0.5 % | ||
| CVE-2022-31187 | >= 10.0.0, < 10.0.3 | Stored Cross Site Scripting (XSS) through global search in GLPI | MEDIUM 6.8 | 0.7 % | ||
| CVE-2022-35946 | >= 0.72, < 10.0.3 | SQL injection through plugin controller in GLPI | MEDIUM 6.5 | 0.9 % | ||
| CVE-2022-35947 | >= 9.1, < 10.0.3 | SQL injection in GLPI | CRITICAL 10.0 | 1.2 % | ||
| CVE-2022-36112 | < 10.0.3 | Blind Server-Side Request Forgery (SSRF) in GLPI | MEDIUM 5.8 | 0.6 % | ||
| CVE-2022-35945 | >= 9.5.0, < 10.0.3 | Cross site scripting (XSS) via registration API in GLPI | MEDIUM 6.3 | 0.7 % | ||
| CVE-2022-31143 | >=9.5.0, < 10.0.3 | Leak of sensitive information through login page error in GLPI | MEDIUM 5.3 | 0.9 % | ||
| CVE-2022-31061 | >= 9.3.0, < 9.5.8 ; >= 10.0.0, < 10.0.2 | SQL injection on login page in GLPI | CRITICAL 9.8 | 51 % | ||
| CVE-2022-31068 | >=10.0.0, < 10.0.2 | Sensitive Data Exposure on Refused Inventory Files in GLPI | MEDIUM 5.3 | 0.9 % | ||
| CVE-2022-31056 | >= 10.0.0, < 10.0.2 | SQL injection with _actor parameter in GLPI | CRITICAL 9.8 | 9.9 % | ||
| CVE-2022-29250 | < 10.0.1 | SQL injection in GLPI | HIGH 8.1 | 0.8 % | ||
| CVE-2022-24876 | < 10.0.1 | Stored cross site scrpting in GLPI's Kanban | MEDIUM 5.4 | 0.5 % | ||
| CVE-2022-24869 | >= 0.90, < 10.0.0 | Cross Site Scripting in GLPI | MEDIUM 5.4 | 0.8 % | ||
| CVE-2022-24868 | < 10.0.0 | Cross site scripting via SVG file upload in GLPI | HIGH 7.3 | 0.6 % | ||
| CVE-2022-24867 | < 10.0.0 | LDAP password exposure in glpi | HIGH 7.5 | 1.3 % | ||
| CVE-2021-39213 | >= 9.1, < 9.5.6 | IP restriction on GLPI API Bypass with custom header injection | HIGH 8.8 | 1.0 % | ||
| CVE-2021-39211 | >= 9.2, < 9.5.6 | Disclosure of GLPI and server information in telemetry endpoint | MEDIUM 5.3 | 4.5 % | ||
| CVE-2021-39210 | < 9.5.6 | Autologin cookie accessible by scripts | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-39209 | < 9.5.6 | Bypassable CSRF protection | HIGH 8.8 | 0.5 % | ||
| CVE-2021-21324 | < 9.5.4 | Insecure Direct Object Reference (IDOR) on "Solutions" | MEDIUM 6.8 | 1.4 % | ||
| CVE-2021-21325 | < 9.5.4 | Stored XSS in budget type | MEDIUM 6.2 | 0.6 % | ||
| CVE-2021-21326 | < 9.5.4 | Horizontal Privilege Escalation | HIGH 7.7 | 1.4 % | ||
| CVE-2021-21327 | < 9.5.4 | Unsafe Reflection in getItemForItemtype() | HIGH 7.5 | 2.5 % | ||
| CVE-2021-21314 | < 9.5.4 | XSS injection on ticket update | MEDIUM 5.4 | 0.6 % | ||
| CVE-2021-21312 | < 9.5.4 | Stored XSS on documents | MEDIUM 5.4 | 0.6 % | ||
| CVE-2021-21313 | < 9.5.4 | XSS on tabs | MEDIUM 6.1 | 0.9 % | ||
| CVE-2021-21258 | >= 9.5.0, < 9.5.4 | XSS injection in ajax/kanban | MEDIUM 6.8 | 0.6 % | ||
| CVE-2021-21255 | = 9.5.3 | entities switch IDOR | MEDIUM 5.8 | 0.9 % | ||
| CVE-2020-26212 | < 9.5.3 | Any GLPI CalDAV calendars is read-only for every authenticated user | HIGH 7.7 | 1.2 % | ||
| CVE-2020-15226 | >= 9.1, < 9.5.2 | SQL Injection in GLPI Search API | MEDIUM 5.0 | 1.0 % | ||
| CVE-2020-15217 | >= 9.5.0, < 9.5.2 | User data exposure in GLPI | MEDIUM 5.3 | 1.0 % | ||
| CVE-2020-15177 | >= 0.65, < 9.5.2 | Unauthenticated Stored XSS in GLPI | HIGH 8.0 | 0.8 % | ||
| CVE-2020-15176 | >= 0.6.8, < 9.5.2 | SQL injection in GLPI | HIGH 8.7 | 1.1 % | ||
| CVE-2020-15175 | < 9.5.2 | Unauthenticated File Deletion in GLPI | CRITICAL 9.1 | 70 % | ||
| CVE-2020-11031 | < 9.5.0 | Insecure encryption algorithm in GLPI | HIGH 7.8 | 0.3 % | ||
| CVE-2020-15108 | < 9.5.1 | SQL Injection in glpi | HIGH 7.1 | 1.2 % | ||
| CVE-2020-11060 | < 9.4.6 | Remote Code Execution in GLPI | HIGH 8.8 | 11 % | ||
| CVE-2020-5248 | < 9.4.6 | Public GLPIKEY can be used to decrypt any data in GLPI | HIGH 7.2 | 1.5 % | ||
| CVE-2020-11036 | < 9.4.6 | XSS in GLPI | HIGH 7.6 | 0.8 % | ||
| CVE-2020-11035 | > 0.83.3, < 9.4.6 | weak CSRF tokens in GLPI | CRITICAL 9.3 | 0.9 % | ||
| CVE-2020-11034 | < 9.4.6 | bypass of manageRedirect in GLPI | MEDIUM 6.1 | 7.6 % | ||
| CVE-2020-11033 | >9.1, < 9.4.6 | Able to read any token through API user endpoint in GLPI | HIGH 7.2 | 1.0 % | ||
| CVE-2020-11032 | < 9.4.6 | SQL injection on addme_observer and addme_assign in GLPI | HIGH 7.6 | 1.0 % |