Skip to contentGlpi-project vulnerabilities
Newest
- glpi-project glpiGLPI technicians can access unauthorized information through external linksCVE-2025-531132.7 Low
- glpi-project glpiGLPI's incomprehensive permission checks can lead to data removal from allowed usersCVE-2025-531124.3 Medium
- glpi-project glpiGLPI exposes data to non-allowed usersCVE-2025-531116.5 Medium
- glpi-project glpiGLPI's MailCollector Receiver is vulnerable to credential exfiltrationCVE-2025-530086.5 Medium
- glpi-project glpiGLPI is vulnerable to XSS and open redirection attacks through planning featureCVE-2025-528976.5 Medium
- glpi-project glpiGLPI has overly permissive URL verificationCVE-2025-525673.5 Low
- glpi-project glpiGLPI is susceptible to Stored XSS attack through project's kanbanCVE-2025-275144.5 Medium
- glpi-project glpi-inventory-pluginGLPI Inventory plugin has Improper Access Control VulnerabilityCVE-2025-271478.2 High
- glpi-project glpiGLPI allows authenticated remote code executionCVE-2025-24801Public exploitEPSS 21.1%8.6 High
- glpi-project glpiGLPI allows unauthenticated SQL injection through the inventory endpointCVE-2025-24799Public exploitEPSS 86.8%7.5 High
- glpi-project glpiGLPI allows SQL injection through the rules configurationCVE-2025-216198.2 High
- glpi-project glpi-inventory-pluginGLPI Inventory Plugin vulnerable to reflective Cross-site ScriptingCVE-2025-266266.5 Medium
- glpi-project glpiGLPI allows unauthorized access to debug modeCVE-2025-251926.5 Medium
- glpi-project glpiGLPI vulnerable to unauthorized authentication by email using the OAuthIMAP pluginCVE-2025-230466.3 Medium
- glpi-project glpiGLPI: Plugins are disabled accessing one pageCVE-2025-230246.9 Medium
- glpi-project glpiGLPI Cross-site Scripting vulnerabilityCVE-2025-216276.5 Medium
- glpi-project glpiGLPI vulnerable to exposure of sensitive information in the `status.php` endpointCVE-2025-216265.8 Medium
- glpi-project glpiGLPI index.php redirectCVE-2024-119555.3 Medium
- glpi-project glpiGLPI vulnerable to unauthenticated session hijackingCVE-2024-50339EPSS 18.7%9.3 Critical
- glpi-project glpiGLPI vulnerable to authenticated insecure account deletionCVE-2024-489127.2 High
- glpi-project glpiGLPI vulnerable to account takeover via the password reset featureCVE-2024-477617.5 High
- glpi-project glpiGLPI vulnerable to account takeover via APICVE-2024-477607.5 High
- glpi-project glpiGLPI vulnerable to account takeover without privilege escalation through the APICVE-2024-477587.6 High
- glpi-project glpiGLPI vulnerable to enumeration of users' email addresses by unauthenticated userCVE-2024-43416Public exploit7.5 High
- glpi-project glpiGLPI allows API document download without rightsCVE-2024-383705.3 Medium
- glpi-project glpiGLPI has a stored XSS at src/RSSFeed.phpCVE-2024-456115.7 Medium
- glpi-project glpiGLPI has a reflected XSS in ajax/cable.phpCVE-2024-456106.5 Medium
- glpi-project glpiGLPI has a Reflected XSS in /front/stat.graph.phpCVE-2024-456096.5 Medium
- glpi-project glpiGLPI has an Authenticated SQL InjectionCVE-2024-456086.5 Medium
- glpi-project glpiGLPI has multiple reflected XSSCVE-2024-434186.5 Medium
- glpi-project glpiReflected XSS in Software formCVE-2024-434176.5 Medium
- glpi-project glpiAuthenticated SQL injection in ticket formCVE-2024-416796.5 Medium
- glpi-project glpiGLPI has multiple reflected XSSCVE-2024-416786.5 Medium
- glpi-project glpiGLPI allows account takeover via SQL Injection in AJAX scriptsCVE-2024-40638EPSS 38.3%8.1 High
- glpi-project glpiGLPI has a stored XSS via document uploadCVE-2024-477596.7 Medium
- glpi-project glpiGLPI allows remote code execution through the plugin loaderCVE-2024-37149EPSS 21.1%7.2 High
- glpi-project glpiGLPI allows account takeover via SQL Injection in AJAX scriptsCVE-2024-37148EPSS 20.2%8.1 High
- glpi-project glpiGLPI allows Authenticated File Upload to Restricted TicketsCVE-2024-37147Public exploit4.3 Medium
- glpi-project glpiGLPI contains an authenticated SQL injectionCVE-2024-31456EPSS 59.1%7.7 High
- glpi-project glpiGLPI contains an SQL injection through the saved searchesCVE-2024-29889EPSS 64.7%7.1 High
- glpi-project glpiAn issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary...CVE-2024-317059.8 Critical
- glpi-project glpi-agent, glpi agent, gldpi-project gldpi-agent +2 moreGlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folderCVE-2024-282417.3 High
- glpi-project glpi-agent, glpi agent +1 moreGLPI-Agent's MSI package installation permits local users to change Agent configurationCVE-2024-282407.3 High
- glpi-project glpiReflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPICVE-2024-27914Public exploit5.3 Medium
- glpi-project glpiStored XSS in dashboards in GLPICVE-2024-271044.5 Medium
- glpi-project glpiBlind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPICVE-2024-27098EPSS 35.7%6.4 Medium
- glpi-project glpiSQL Injection in through the search engineCVE-2024-27096EPSS 58.8%7.7 High
- glpi-project glpiSensitive fields access through dropdowns in GLPICVE-2024-279306.5 Medium
- glpi-project glpiglpi Users emails enumerationCVE-2024-27937EPSS 27.1%6.5 Medium
- glpi-project glpiAn issue in GLPI v.10.0.12 and before allows a remote attacker to execute arbitrary code,...CVE-2024-277568.8 High
- Show moreLoading…