Glpi-project vulnerabilities

Products

• Glpi 220
• Glpi-inventory-plugin 7
• Glpi Inventory 4
• Glpi-agent 3
• Glpi Agent 3

Newest

• glpi-project glpi GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds CVE-2026-53631 5.3 MediumNovember 4, 2026
• glpi-project glpi GLPI: Blind Time based SQLI in dropdowns CVE-2026-47678 8.7 HighNovember 4, 2026
• glpi-project glpi GLPI: MFA bypass CVE-2026-52848 9.2 CriticalNovember 4, 2026
• glpi-project glpi GLPI: Unallowed notifications sending CVE-2026-57152 7.1 HighNovember 4, 2026
• glpi-project glpi GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning CVE-2026-121559 8.6 HighNovember 3, 2026
• glpi-project glpi GLPI through 12.0.0 Missing Authorization via ajax/map.php CVE-2026-108726 5.3 MediumOctober 11, 2026
• glpi-project glpi GLPI: SQL injection in history tab CVE-2026-53629 Public exploit 7.1 HighSeptember 25, 2026
• glpi-project glpi GLPI: Arbitrary Document Read via Form Context Authorization Bypass CVE-2026-53626 7.1 HighSeptember 25, 2026
• glpi-project glpi GLPI: RCE via Form import CVE-2026-48482 9.4 CriticalSeptember 25, 2026
• glpi-project glpi GLPI: Privilege Escalation via authtype API manipulation CVE-2026-53625 Public exploit 7.5 HighSeptember 25, 2026
• glpi-project glpi GLPI: Reflected XSS in dashboards CVE-2026-53610 7.5 HighSeptember 25, 2026
• glpi-project glpi GLPI: arbitrary file deletion CVE-2026-47679 8.5 HighSeptember 25, 2026
• glpi-project glpi GLPI: Stored XSS in suppliers CVE-2026-55214 8.5 HighSeptember 25, 2026
• glpi-project glpi GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force CVE-2026-49470 7.7 HighSeptember 25, 2026
• glpi-project glpi GLPI: Unallowed modfication of knowbase items comments and translations CVE-2026-55217 5.3 MediumSeptember 25, 2026
• glpi-project glpi GLPI: Unallowed authentication method update by administrator CVE-2026-53628 5.9 MediumSeptember 25, 2026
• glpi-project glpi GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) CVE-2026-45801 5.3 MediumSeptember 25, 2026
• glpi-project glpi GLPI: Unexpected access to update operations through the API CVE-2026-53627 6.0 MediumSeptember 25, 2026
• glpi-project glpi GLPI: LDAP filter injection in user import feature CVE-2026-49469 4.6 MediumSeptember 25, 2026
• glpi-project glpi glpi-project glpi Document document.send.php canViewFile authorization CVE-2026-13490 6.3 MediumJune 28, 2026
• glpi-project glpi GLPI has stored XSS in asset locks CVE-2026-42321 8.4 HighJune 3, 2026
• glpi-project glpi GLPI vulnerable to arbitrary file access CVE-2026-42320 5.9 MediumJune 3, 2026
• glpi-project glpi GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint CVE-2026-42318 7.0 HighJune 3, 2026
• glpi-project glpi GLPI vulnerable to arbitrary files deletion by technician CVE-2026-42317 7.0 HighJune 3, 2026
• glpi-project glpi GLPI vulnerable to unauthorized reading of a specific asset object CVE-2026-44281 7.0 HighJune 3, 2026
• glpi-project glpi GLPI Vulnerable to Stored XSS in ITIL Costs CVE-2026-40108 7.1 HighJune 2, 2026
• glpi-project glpi GLPI 11.0.0 - Stored XSS in knowledge base CVE-2026-5385 8.4 HighJune 2, 2026
• glpi-project glpi GLPI: Unauthorized export of form structure CVE-2026-32312 5.1 MediumMay 18, 2026
• glpi-project glpi GLPI has an Authenticated SQL Injection via log exports CVE-2026-29047 7.2 HighApril 6, 2026
• glpi-project glpi GLPI has an Unauthenticated SQL Injection via Search engine CVE-2026-26263 8.1 HighApril 6, 2026
• glpi-project glpi GLPI has an Unauthenticated Stored XSS via inventory CVE-2026-26027 7.5 HighApril 6, 2026
• glpi-project glpi GLPI has a Server-Side Template Injection via Double-Compilation CVE-2026-26026 Public exploit EPSS 12.0% 9.1 CriticalApril 6, 2026
• glpi-project glpi GLPI has Stored XSS in Supplier 'Website' field CVE-2026-25932 7.2 HighApril 6, 2026
• glpi-project glpi inventory, glpi-inventory-plugin +1 more GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report CVE-2026-26001 7.1 HighMarch 17, 2026
• glpi-project glpi GLPI has a MFA bypass CVE-2026-25937 6.5 MediumMarch 17, 2026
• glpi-project glpi GLPI Vulnerable to Authenticated SQL Injection CVE-2026-25936 6.5 MediumMarch 17, 2026
• glpi-project glpi GLPI affected by Remote Code Execution via malicious upload CVE-2026-22248 8.1 HighMarch 11, 2026
• glpi-project glpi inventory, glpi-inventory-plugin +1 more GLPI Inventory Plugin has Reflected XSS in task jobs CVE-2026-25590 4.5 MediumMarch 3, 2026
• glpi-project more reporting, pluginsglpi mreporting +1 more mreporting affected by a SQLI on date change CVE-2026-22821 4.9 MediumFebruary 12, 2026
• glpi-project glpi GLPI is Vulnerable to Authenticated SQL Injection CVE-2026-22044 6.5 MediumFebruary 4, 2026
• glpi-project glpi GLPI is vulnerable to session stealing on externally authenticated user change CVE-2026-23624 4.3 MediumFebruary 4, 2026
• glpi-project glpi GLPI is Vulnerable to SSRF via Webhooks CVE-2026-22247 4.1 MediumFebruary 4, 2026
• glpi-project glpi GLPI has an unauthenticated SQL injection through the inventory endpoint CVE-2025-66417 Public exploit 7.5 HighJanuary 15, 2026
• glpi-project glpi GLPI incorrectly authorizes access to documents CVE-2025-64516 Public exploit 7.5 HighJanuary 15, 2026
• glpi-project glpi GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint CVE-2023-53943 6.9 MediumDecember 18, 2025
• glpi-project glpi GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API CVE-2025-64520 6.5 MediumDecember 16, 2025
• glpi-project glpi GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page CVE-2025-59935 6.5 MediumDecember 16, 2025
• glpi-project glpi-inventory-plugin GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection CVE-2025-32786 7.5 HighNovember 4, 2025
• glpi-project glpi GLPI permits unauthorized rules execution order CVE-2025-53105 7.5 HighAugust 27, 2025
• glpi-project glpi GLPI permits reservation modification by unauthorized users CVE-2025-53357 5.4 MediumJuly 30, 2025
• Show olderLoading…