Vulnerabilities

TI-2026-24840 CVE-2026-32312

GLPI: Unauthorized export of form structure

LOW 23

GLPI is a free asset and IT management software package.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00217 Published 2026-05-18 Fixed in 11.0.7 CWE-862

TI-2026-23192 CVE-2026-29047

GLPI has an Authenticated SQL Injection via log exports

MEDIUM 40

GLPI is a free asset and IT management software package.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00403 Published 2026-04-06 Fixed in 11.0.6 CWE-89

TI-2026-21233 CVE-2026-26263

GLPI has an Unauthenticated SQL Injection via Search engine

MEDIUM 54

GLPI is a free asset and IT management software package.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08403 Published 2026-04-06 Fixed in 11.0.6 CWE-89

TI-2026-21041 CVE-2026-26027

GLPI has an Unauthenticated Stored XSS via inventory

LOW 34

GLPI is a free asset and IT management software package.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00198 Published 2026-04-06 Fixed in 11.0.6 CWE-116

TI-2026-21040 CVE-2026-26026

GLPI has a Server-Side Template Injection via Double-Compilation

MEDIUM 55

GLPI is a free asset and IT management software package.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.11959 Published 2026-04-06 Fixed in 11.0.6 CWE-1336

TI-2026-20962 CVE-2026-25932

GLPI has Stored XSS in Supplier 'Website' field

LOW 33

GLPI is a Free Asset and IT Management Software package.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00285 Published 2026-04-06 Fixed in 10.0.24 CWE-116

TI-2026-17738 CVE-2026-22044

GLPI is Vulnerable to Authenticated SQL Injection

LOW 38

GLPI is a free asset and IT management software package.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00314 Published 2026-02-04 Fixed in 10.0.23 CWE-89

TI-2026-19025 CVE-2026-23624

GLPI is vulnerable to session stealing on externally authenticated user change

LOW 29

GLPI is a free asset and IT management software package.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00428 Published 2026-02-04 Fixed in 10.0.23, 11.0.5 CWE-384

TI-2026-17857 CVE-2026-22247

GLPI is Vulnerable to SSRF via Webhooks

LOW 39

GLPI is a free asset and IT management software package.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00352 Published 2026-02-04 Fixed in 11.0.5 CWE-918

TI-2025-40853 CVE-2025-66417

GLPI has an unauthenticated SQL injection through the inventory endpoint

MEDIUM 49

GLPI is a free asset and IT management software package.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00473 Published 2026-01-15 Fixed in 11.0.3 CWE-89

TI-2025-39906 CVE-2025-64516

GLPI incorrectly authorizes access to documents

LOW 39

GLPI is a free asset and IT management software package.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00329 Published 2026-01-15 Fixed in 10.0.21, 11.0.3 CWE-284

TI-2023-30226 CVE-2023-53943 · GHSA-5w2x-g68p-qvmf

GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint

HIGH 70

GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00353 Published 2025-12-18 No fix listed CWE-203

TI-2025-39910 CVE-2025-64520

GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API

LOW 34

GLPI is a free asset and IT management software package.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00216 Published 2025-12-16 Fixed in 10.0.21 CWE-862

TI-2025-37323 CVE-2025-59935

GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page

LOW 29

GLPI is a free asset and IT management software package.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00288 Published 2025-12-16 Fixed in 10.0.21 CWE-79

TI-2025-33321 CVE-2025-53357

GLPI permits reservation modification by unauthorized users

LOW 24

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00211 Published 2025-07-30 Fixed in 10.0.19 CWE-639

TI-2025-33106 CVE-2025-53113

GLPI technicians can access unauthorized information through external links

LOW 13

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00268 Published 2025-07-30 Fixed in 10.0.19 CWE-284

TI-2025-33105 CVE-2025-53112

GLPI's incomprehensive permission checks can lead to data removal from allowed users

LOW 20

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00233 Published 2025-07-30 Fixed in 10.0.19 CWE-284

TI-2025-33104 CVE-2025-53111

GLPI exposes data to non-allowed users

LOW 29

GLPI is a Free Asset and IT Management Software package.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00307 Published 2025-07-30 Fixed in 10.0.19 CWE-284

TI-2025-33012 CVE-2025-53008

GLPI's MailCollector Receiver is vulnerable to credential exfiltration

LOW 29

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00307 Published 2025-07-30 Fixed in 10.0.19 CWE-522

TI-2025-32933 CVE-2025-52897

GLPI is vulnerable to XSS and open redirection attacks through planning feature

LOW 28

GLPI is a Free Asset and IT Management Software package.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00252 Published 2025-07-30 Fixed in 10.0.19 CWE-601

TI-2025-32662 CVE-2025-52567

GLPI has overly permissive URL verification

LOW 22

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00216 Published 2025-07-30 Fixed in 10.0.19 CWE-918

TI-2025-20346 CVE-2025-27514

GLPI is susceptible to Stored XSS attack through project's kanban

LOW 24

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00218 Published 2025-07-29 Fixed in 10.0.19 CWE-79

TI-2025-18518 CVE-2025-24801

GLPI allows authenticated remote code execution

MEDIUM 59

GLPI is a free asset and IT management software package.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.21148 Published 2025-03-18 Fixed in 10.0.18 CWE-434

TI-2025-18516 CVE-2025-24799

GLPI allows unauthenticated SQL injection through the inventory endpoint

CRITICAL 90

GLPI is a free asset and IT management software package.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.86807 Published 2025-03-18 Fixed in 10.0.18 CWE-89

TI-2025-15579 CVE-2025-21619

GLPI allows SQL injection through the rules configuration

LOW 36

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00442 Published 2025-03-18 Fixed in 10.0.18 CWE-89

Vulnerabilities

Filters