Skip to contentGlpi-project vulnerabilities
Newest
- glpi-project glpiSQL Injection on REST API in GLPICVE-2022-39323EPSS 37.4%7.4 High
- glpi-project glpiCross-Site Scripting (XSS) in external links in GLPICVE-2022-392774.5 Medium
- glpi-project glpiBlind Server-Side Request Forgery (SSRF) in RSS feeds and planningCVE-2022-392763.5 Low
- glpi-project glpiStored Cross-Site Scripting (XSS) on login page in GLPICVE-2022-392625.2 Medium
- glpi-project glpiuser session persists even after permanently deleting account in GLPICVE-2022-392344.7 Medium
- glpi-project glpiTeclib GLPI Remote Code Execution VulnerabilityCVE-2022-35914In KEVPublic exploitEPSS 99.9%9.8 Critical
- glpi-project glpiStored Cross Site Scripting (XSS) through global search in GLPICVE-2022-311876.8 Medium
- glpi-project glpiSQL injection through plugin controller in GLPICVE-2022-359465.5 Medium
- glpi-project glpiSQL injection in GLPICVE-2022-3594710.0 Critical
- glpi-project glpiBlind Server-Side Request Forgery (SSRF) in GLPICVE-2022-361123.5 Low
- glpi-project glpiCross site scripting (XSS) via registration API in GLPICVE-2022-359456.3 Medium
- glpi-project glpiLeak of sensitive information through login page error in GLPICVE-2022-311435.3 Medium
- glpi-project glpiSQL injection on login page in GLPICVE-2022-31061Public exploitEPSS 51.4%9.8 Critical
- glpi-project glpiSensitive Data Exposure on Refused Inventory Files in GLPICVE-2022-310685.3 Medium
- glpi-project glpiSQL injection with _actor parameter in GLPICVE-2022-31056Public exploit9.8 Critical
- glpi-project glpi-inventory-plugin, glpi inventory +1 moreSQL Injection via package deployment tasks in glpi-inventory-pluginCVE-2022-310825.8 Medium
- glpi-project glpi-inventory-plugin, glpi inventory +1 moreUnauthenticated Local File InclusionCVE-2022-31062Public exploit5.3 Medium
- glpi-project glpiSQL injection in GLPICVE-2022-292508.1 High
- glpi-project glpiStored cross site scrpting in GLPI's KanbanCVE-2022-248765.4 Medium
- glpi-project glpiCross Site Scripting in GLPICVE-2022-248694.6 Medium
- glpi-project glpiCross site scripting via SVG file upload in GLPICVE-2022-248687.3 High
- glpi-project glpiLDAP password exposure in glpiCVE-2022-248677.5 High
- glpi-project glpiA SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in...CVE-2021-446179.8 Critical
- glpi-project glpiSQL injection using custom CSS administration form in GLPICVE-2022-217204.9 Medium
- glpi-project glpiReflected XSS using reload button in GLPICVE-2022-217196.1 Medium
- glpi-project barcodePath traversal in GLPI barcode pluginCVE-2021-43778Public exploitEPSS 51.7%9.1 Critical
- glpi-project glpiIP restriction on GLPI API Bypass with custom header injectionCVE-2021-392136.8 Medium
- glpi-project glpiDisclosure of GLPI and server information in telemetry endpointCVE-2021-392115.3 Medium
- glpi-project glpiAutologin cookie accessible by scriptsCVE-2021-392106.5 Medium
- glpi-project glpiBypassable CSRF protectionCVE-2021-392098.8 High
- glpi-project glpiGLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.CVE-2021-34866.1 Medium
- glpi-project dashboardThe Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access...CVE-2021-301444.3 Medium
- glpi-project glpiInsecure Direct Object Reference (IDOR) on "Solutions"CVE-2021-213246.8 Medium
- glpi-project glpiStored XSS in budget typeCVE-2021-213256.2 Medium
- glpi-project glpiHorizontal Privilege EscalationCVE-2021-213267.7 High
- glpi-project glpiUnsafe Reflection in getItemForItemtype()CVE-2021-213276.8 Medium
- glpi-project glpiXSS injection on ticket updateCVE-2021-213145.4 Medium
- glpi-project glpiStored XSS on documentsCVE-2021-213125.4 Medium
- glpi-project glpiXSS on tabsCVE-2021-213134.9 Medium
- glpi-project glpiXSS injection in ajax/kanbanCVE-2021-212586.8 Medium
- glpi-project glpientities switch IDORCVE-2021-212555.8 Medium
- glpi-project glpiIn GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).CVE-2020-276634.3 Medium
- glpi-project glpiIn GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.)…CVE-2020-276624.3 Medium
- glpi-project glpiAny GLPI CalDAV calendars is read-only for every authenticated userCVE-2020-262127.7 High
- glpi-project glpiSQL Injection in GLPI Search APICVE-2020-152265.0 Medium
- glpi-project glpiUser data exposure in GLPICVE-2020-152175.3 Medium
- glpi-project glpiUnauthenticated Stored XSS in GLPICVE-2020-151778.0 High
- glpi-project glpiSQL injection in GLPICVE-2020-151768.7 High
- glpi-project glpiUnauthenticated File Deletion in GLPICVE-2020-15175Public exploitEPSS 69.9%7.4 High
- glpi-project glpiInsecure encryption algorithm in GLPICVE-2020-110317.8 High
- Show moreLoading…