pluginsGLPI

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

pluginsGLPI records in CISA KEV

No pluginsGLPI vulnerabilities are listed in CISA KEV.

Records

7 records

TI-2024-36046 CVE-2024-53850

The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation

MEDIUM 42

The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network..

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00527 Published 2024-12-26 No fix listed CWE-470

TI-2026-38943 CVE-2026-53987 · GHSA-qc6r-wrm6-23pm

Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering

LOW 35

The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-s…

CVSS 4.0HIGH 7.3 Network High privileges User interaction EPSS 0.00503 Published 2026-07-09 Fixed in 2.14.4 CWE-79

TI-2025-20010 CVE-2025-27153

Escalade GLPI Plugin Vulnerable to Improper Access Control

LOW 35

Escalade GLPI plugin is a ticket escalation process helper for GLPI.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00276 Published 2025-07-01 Fixed in 2.9.11 CWE-284

TI-2026-09772 CVE-2026-11321 · GHSA-q93h-qc46-87rr

GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import

LOW 34

The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL inje…

CVSS 4.0HIGH 7.1 Network High privileges User interaction EPSS 0.00423 Published 2026-07-10 Fixed in 2.15.7 CWE-89

TI-2024-30621 CVE-2024-45600

Fields GLPI plugin has an Authenticated SQL Injection

LOW 34

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00486 Published 2024-12-26 Fixed in 1.21.13 CWE-89

TI-2025-40221 CVE-2025-65035

GLPI Database Inventory Plugin Vulnerable to Stored Object Injection

LOW 30

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation.

CVSS 3.1MEDIUM 6.4 Network High privileges User interaction EPSS 0.00324 Published 2025-12-19 Fixed in 1.1.2 CWE-502

TI-2025-33324 CVE-2025-53360

pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests

LOW 20

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00313 Published 2025-11-18 Fixed in 1.0.3 CWE-284

Open these records in search →

Critical	0
High	4
Medium	3
Low	0
No CVSS	0