Skip to contentGlpi-project Glpi vulnerabilities
- glpi-project glpiSQL injection through plugin controller in GLPICVE-2022-359465.5 Medium
- glpi-project glpiSQL injection in GLPICVE-2022-3594710.0 Critical
- glpi-project glpiBlind Server-Side Request Forgery (SSRF) in GLPICVE-2022-361123.5 Low
- glpi-project glpiCross site scripting (XSS) via registration API in GLPICVE-2022-359456.3 Medium
- glpi-project glpiLeak of sensitive information through login page error in GLPICVE-2022-311435.3 Medium
- glpi-project glpiSQL injection on login page in GLPICVE-2022-31061Public exploitEPSS 51.4%9.8 Critical
- glpi-project glpiSensitive Data Exposure on Refused Inventory Files in GLPICVE-2022-310685.3 Medium
- glpi-project glpiSQL injection with _actor parameter in GLPICVE-2022-31056Public exploit9.8 Critical
- glpi-project glpi-inventory-plugin, glpi inventory +1 moreSQL Injection via package deployment tasks in glpi-inventory-pluginCVE-2022-310825.8 Medium
- glpi-project glpi-inventory-plugin, glpi inventory +1 moreUnauthenticated Local File InclusionCVE-2022-31062Public exploit5.3 Medium
- glpi-project glpiSQL injection in GLPICVE-2022-292508.1 High
- glpi-project glpiStored cross site scrpting in GLPI's KanbanCVE-2022-248765.4 Medium
- glpi-project glpiCross Site Scripting in GLPICVE-2022-248694.6 Medium
- glpi-project glpiCross site scripting via SVG file upload in GLPICVE-2022-248687.3 High
- glpi-project glpiLDAP password exposure in glpiCVE-2022-248677.5 High
- glpi-project glpiA SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in...CVE-2021-446179.8 Critical
- glpi-project glpiSQL injection using custom CSS administration form in GLPICVE-2022-217204.9 Medium
- glpi-project glpiReflected XSS using reload button in GLPICVE-2022-217196.1 Medium
- glpi-project glpiIP restriction on GLPI API Bypass with custom header injectionCVE-2021-392136.8 Medium
- glpi-project glpiDisclosure of GLPI and server information in telemetry endpointCVE-2021-392115.3 Medium
- glpi-project glpiAutologin cookie accessible by scriptsCVE-2021-392106.5 Medium
- glpi-project glpiBypassable CSRF protectionCVE-2021-392098.8 High
- glpi-project glpiGLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.CVE-2021-34866.1 Medium
- glpi-project glpiInsecure Direct Object Reference (IDOR) on "Solutions"CVE-2021-213246.8 Medium
- glpi-project glpiStored XSS in budget typeCVE-2021-213256.2 Medium
- glpi-project glpiHorizontal Privilege EscalationCVE-2021-213267.7 High
- glpi-project glpiUnsafe Reflection in getItemForItemtype()CVE-2021-213276.8 Medium
- glpi-project glpiXSS injection on ticket updateCVE-2021-213145.4 Medium
- glpi-project glpiStored XSS on documentsCVE-2021-213125.4 Medium
- glpi-project glpiXSS on tabsCVE-2021-213134.9 Medium
- glpi-project glpiXSS injection in ajax/kanbanCVE-2021-212586.8 Medium
- glpi-project glpientities switch IDORCVE-2021-212555.8 Medium
- glpi-project glpiIn GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).CVE-2020-276634.3 Medium
- glpi-project glpiIn GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.)…CVE-2020-276624.3 Medium
- glpi-project glpiAny GLPI CalDAV calendars is read-only for every authenticated userCVE-2020-262127.7 High
- glpi-project glpiSQL Injection in GLPI Search APICVE-2020-152265.0 Medium
- glpi-project glpiUser data exposure in GLPICVE-2020-152175.3 Medium
- glpi-project glpiUnauthenticated Stored XSS in GLPICVE-2020-151778.0 High
- glpi-project glpiSQL injection in GLPICVE-2020-151768.7 High
- glpi-project glpiUnauthenticated File Deletion in GLPICVE-2020-15175Public exploitEPSS 69.9%7.4 High
- glpi-project glpiInsecure encryption algorithm in GLPICVE-2020-110317.8 High
- glpi-project glpiSQL Injection in glpiCVE-2020-151087.1 High
- glpi-project glpiRemote Code Execution in GLPICVE-2020-11060Public exploitEPSS 10.7%7.4 High
- glpiReflexive XSS in GLPICVE-2020-110626.0 Medium
- glpi-project glpiPublic GLPIKEY can be used to decrypt any data in GLPICVE-2020-5248Public exploit7.2 High
- glpi-project glpiXSS in GLPICVE-2020-110367.6 High
- glpi-project glpi, fedoraproject fedora +1 moreweak CSRF tokens in GLPICVE-2020-110357.5 High
- glpi-project glpibypass of manageRedirect in GLPICVE-2020-110346.1 Medium
- glpi-project glpi, fedoraproject fedora +1 moreAble to read any token through API user endpoint in GLPICVE-2020-110336.6 Medium
- glpi-project glpiSQL injection on addme_observer and addme_assign in GLPICVE-2020-110327.6 High
- Show moreLoading…