Priority CRITICAL 100KEV
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99851 · Published 2022-09-19 · No fix listed CWE-74
Priority CRITICAL 90
GLPI is a free asset and IT management software package.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.86807 · Published 2025-03-18 · Fixed in 10.0.18 CWE-89
Priority CRITICAL 85
GLPI is a free asset and IT management software package.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.67726 · Published 2023-12-13 · Fixed in 10.0.11 CWE-89
Priority HIGH 82
The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07809 · Published 2023-04-16 · No fix listed CWE-434
Priority HIGH 80
GLPI is a free asset and IT management software package.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.52381 · Published 2023-07-05 · Fixed in 10.0.8 CWE-89
Priority HIGH 80
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.51403 · Published 2022-06-28 · Fixed in 9.5.8, 10.0.2 CWE-89
Priority HIGH 78
GLPI is a free asset and IT management software package.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.47557 · Published 2023-07-05 · Fixed in 10.0.8 CWE-89
Priority HIGH 77
In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.69859 · Published 2020-10-07 · Fixed in 9.5.2 CWE-552
Priority HIGH 73
GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00742 · Published 2024-03-15 · No fix listed CWE-94
Priority HIGH 72
An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item.
CVSS 4.0HIGH 8.4· Network · High privileges · User interaction · EPSS 0.00418 · Published 2026-06-02 · Fixed in 11.0.7 CWE-79
Priority HIGH 72
The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0677 · Published 2023-04-16 · No fix listed CWE-22
Priority HIGH 72
The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01172 · Published 2023-04-16 · No fix listed CWE-22
Priority HIGH 71
GLPI is a Free Asset and IT Management Software package.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.64691 · Published 2024-05-07 · Fixed in 10.0.15 CWE-89
Priority HIGH 71
Barcode is a GLPI plugin for printing barcodes and QR codes.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.52658 · Published 2021-11-24 · Fixed in 2.6.1 CWE-22
Priority HIGH 70
GLPI is a Free Asset and IT Management Software package.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.59136 · Published 2024-05-07 · Fixed in 10.0.15 CWE-89
Priority HIGH 70
GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00353 · Published 2025-12-18 · No fix listed CWE-203
Priority HIGH 69
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.362 · Published 2023-09-26 · Fixed in 10.0.10 CWE-89
Priority HIGH 69
GLPI stands for Gestionnaire Libre de Parc Informatique.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.37447 · Published 2022-11-03 · Fixed in 10.0.4 CWE-89
Priority HIGH 68
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.58818 · Published 2024-03-18 · Fixed in 10.0.13 CWE-89
Priority HIGH 67
GLPI is a free asset and IT management software package.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.38299 · Published 2024-11-15 · Fixed in 10.0.17 CWE-89
Priority HIGH 67
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.3572 · Published 2024-03-18 · Fixed in 10.0.13 CWE-918
Priority HIGH 66
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.36508 · Published 2023-09-26 · Fixed in 10.0.10 CWE-269
Priority MEDIUM 62
GLPI is a free asset and IT management software package.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.30915 · Published 2023-12-13 · Fixed in 10.0.11 CWE-89
Priority MEDIUM 62
front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file parameter.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.04607 · Published 2023-04-16 · No fix listed CWE-203
Priority MEDIUM 61
A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00456 · Published 2026-06-28 · No fix listed CWE-285
Load more
THREATIST.IORead the docs