Vulnerabilities

TI-2026-85251 CVE-2026-53631

Missing authorization in GLPI lets users expand item visibility

LOW 24

GLPI is a free asset and IT management software package.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00246 Published 2026-11-04 Fixed in 10.0.27, 11.0.9 CWE-862

TI-2026-85249 CVE-2026-47678

Time-based blind SQL injection in GLPI dropdowns

LOW 37

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00235 Published 2026-11-04 Fixed in 10.0.26, 11.0.8 CWE-89

TI-2026-85250 CVE-2026-52848

Two-factor authentication bypass in GLPI lets attackers log in

MEDIUM 40

GLPI is a free asset and IT management software package.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0037 Published 2026-11-04 Fixed in 11.0.8 CWE-288

TI-2026-85255 CVE-2026-57152

Missing authorization in GLPI exposes documents to users

LOW 31

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00246 Published 2026-11-04 Fixed in 10.0.26, 11.0.8 CWE-862

TI-2026-84365 CVE-2026-121559 · GHSA-r7x3-2pgh-h4g2

Privilege escalation in GLPI via user cloning

MEDIUM 40

GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00488 Published 2026-11-03 Fixed in 10.0.28, 11.0.10 CWE-269

TI-2026-70705 CVE-2026-108726 · GHSA-9wcj-67qp-cm59

Missing authorization in GLPI map endpoint exposes restricted item data

LOW 24

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-10-11 No fix listed CWE-862

TI-2026-38675 CVE-2026-53629

GLPI: SQL injection in history tab

LOW 33

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0102 Published 2026-09-25 Fixed in 10.0.26, 11.0.8 CWE-89

TI-2026-38672 CVE-2026-53626

GLPI: Arbitrary Document Read via Form Context Authorization Bypass

LOW 31

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00303 Published 2026-09-25 Fixed in 11.0.8 CWE-639

TI-2026-35845 CVE-2026-48482

GLPI: RCE via Form import

MEDIUM 42

GLPI is a free asset and IT management software package.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00335 Published 2026-09-25 Fixed in 11.0.8 CWE-22

TI-2026-38671 CVE-2026-53625

GLPI: Privilege Escalation via authtype API manipulation

LOW 36

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00572 Published 2026-09-25 Fixed in 10.0.26, 11.0.8 CWE-862

TI-2026-38666 CVE-2026-53610

GLPI: Reflected XSS in dashboards

LOW 35

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 7.5 Network No auth User interaction EPSS 0.00383 Published 2026-09-25 Fixed in 11.0.8 CWE-79

TI-2026-35184 CVE-2026-47679

GLPI: arbitrary file deletion

LOW 37

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.00324 Published 2026-09-25 Fixed in 10.0.26, 11.0.8 CWE-22

TI-2026-39894 CVE-2026-55214

GLPI: Stored XSS in suppliers

LOW 39

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 8.5 Network High privileges User interaction EPSS 0.00278 Published 2026-09-25 Fixed in 11.0.8 CWE-116

TI-2026-36625 CVE-2026-49470

GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force

LOW 36

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.0036 Published 2026-09-25 Fixed in 11.0.8 CWE-307

TI-2026-39896 CVE-2026-55217

GLPI: Unallowed modfication of knowbase items comments and translations

LOW 24

GLPI is a free asset and IT management software package.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00314 Published 2026-09-25 Fixed in 10.0.26, 11.0.8 CWE-285

TI-2026-38674 CVE-2026-53628

GLPI: Unallowed authentication method update by administrator

LOW 29

GLPI is a free asset and IT management software package.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00452 Published 2026-09-25 Fixed in 10.0.26, 11.0.8 CWE-285

TI-2026-33536 CVE-2026-45801

GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)

LOW 24

GLPI is a free asset and IT management software package.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00314 Published 2026-09-25 Fixed in 10.0.26, 11.0.8 CWE-269

TI-2026-38673 CVE-2026-53627

GLPI: Unexpected access to update operations through the API

LOW 27

GLPI is a free asset and IT management software package.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.0031 Published 2026-09-25 Fixed in 11.0.8 CWE-862

TI-2026-36624 CVE-2026-49469

GLPI: LDAP filter injection in user import feature

LOW 21

GLPI is a free asset and IT management software package.

CVSS 4.0MEDIUM 4.6 Network High privileges No interaction EPSS 0.00399 Published 2026-09-25 Fixed in 10.0.26, 11.0.8 CWE-90

TI-2026-11416 CVE-2026-13490 · GHSA-8cgc-j54m-4q3w

glpi-project glpi Document document.send.php canViewFile authorization

MEDIUM 61

A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00456 Published 2026-06-28 No fix listed CWE-285

TI-2026-30628 CVE-2026-42321

GLPI has stored XSS in asset locks

LOW 38

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 8.4 Network High privileges User interaction EPSS 0.00343 Published 2026-06-03 Fixed in 10.0.25 CWE-116

TI-2026-30627 CVE-2026-42320

GLPI vulnerable to arbitrary file access

LOW 26

GLPI is a free asset and IT management software package.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00239 Published 2026-06-03 Fixed in 11.0.7, 10.0.25 CWE-862

TI-2026-30626 CVE-2026-42318

GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint

LOW 33

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00303 Published 2026-06-03 Fixed in 11.0.7, 10.0.25 CWE-862

TI-2026-30625 CVE-2026-42317

GLPI vulnerable to arbitrary files deletion by technician

LOW 37

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00346 Published 2026-06-03 Fixed in 11.0.7, 10.0.25 CWE-862

TI-2026-32252 CVE-2026-44281

GLPI vulnerable to unauthorized reading of a specific asset object

LOW 30

GLPI is a free asset and IT management software package.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00251 Published 2026-06-03 Fixed in 11.0.7, 10.0.25 CWE-862

Vulnerabilities

Filters