Glpi-Project GLPI

• CVE-2025-52897 Medium 6.5 GLPI is vulnerable to XSS and open redirection attacks through planning feature 0.3%
• CVE-2025-52567 Low 3.5 GLPI has overly permissive URL verification 0.2%
• CVE-2025-27514 Medium 4.5 GLPI is susceptible to Stored XSS attack through project's kanban 0.2%
• CVE-2025-24801 High 8.6 GLPI allows authenticated remote code execution 21.1%
• CVE-2025-24799 High 7.5 GLPI allows unauthenticated SQL injection through the inventory endpoint 86.8%
• CVE-2025-21619 High 8.2 GLPI allows SQL injection through the rules configuration 0.4%
• CVE-2025-25192 Medium 6.5 GLPI allows unauthorized access to debug mode 0.7%
• CVE-2025-23046 Medium 6.3 GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin 0.5%
• CVE-2025-23024 Medium 6.9 GLPI: Plugins are disabled accessing one page 0.3%
• CVE-2025-21627 Medium 6.5 GLPI Cross-site Scripting vulnerability 0.4%
• CVE-2025-21626 Medium 5.8 GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint 0.5%
• CVE-2024-50339 Critical 9.3 GLPI vulnerable to unauthenticated session hijacking 18.7%
• CVE-2024-48912 High 7.2 GLPI vulnerable to authenticated insecure account deletion 0.4%
• CVE-2024-47761 High 7.5 GLPI vulnerable to account takeover via the password reset feature 0.5%
• CVE-2024-47760 High 7.5 GLPI vulnerable to account takeover via API 0.5%
• CVE-2024-47758 High 7.6 GLPI vulnerable to account takeover without privilege escalation through the API 0.5%
• CVE-2024-43416 High 7.5 GLPI vulnerable to enumeration of users' email addresses by unauthenticated user 1.2%
• CVE-2024-38370 Medium 5.3 GLPI allows API document download without rights 0.4%
• CVE-2024-45611 Medium 5.7 GLPI has a stored XSS at src/RSSFeed.php 0.3%
• CVE-2024-45610 Medium 6.5 GLPI has a reflected XSS in ajax/cable.php 0.4%
• CVE-2024-45609 Medium 6.5 GLPI has a Reflected XSS in /front/stat.graph.php 0.4%
• CVE-2024-45608 Medium 6.5 GLPI has an Authenticated SQL Injection 0.5%
• CVE-2024-43418 Medium 6.5 GLPI has multiple reflected XSS 0.4%
• CVE-2024-43417 Medium 6.5 Reflected XSS in Software form 0.4%
• CVE-2024-41679 Medium 6.5 Authenticated SQL injection in ticket form 0.5%
• CVE-2024-41678 Medium 6.5 GLPI has multiple reflected XSS 0.5%
• CVE-2024-40638 High 8.1 GLPI allows account takeover via SQL Injection in AJAX scripts 38.3%
• CVE-2024-47759 Medium 6.7 GLPI has a stored XSS via document upload 0.5%
• CVE-2024-37149 High 7.2 GLPI allows remote code execution through the plugin loader 21.1%
• CVE-2024-37148 High 8.1 GLPI allows account takeover via SQL Injection in AJAX scripts 20.2%
• CVE-2024-37147 Medium 4.3 GLPI allows Authenticated File Upload to Restricted Tickets 0.7%
• CVE-2024-31456 High 7.7 GLPI contains an authenticated SQL injection 59.1%
• CVE-2024-29889 High 7.1 GLPI contains an SQL injection through the saved searches 64.7%
• CVE-2024-27914 Medium 5.3 Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI 0.8%
• CVE-2024-27104 Medium 4.5 Stored XSS in dashboards in GLPI 0.7%
• CVE-2024-27098 Medium 6.4 Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI 35.7%
• CVE-2024-27096 High 7.7 SQL Injection in through the search engine 58.8%
• CVE-2024-27930 Medium 6.5 Sensitive fields access through dropdowns in GLPI 1.1%
• CVE-2024-27937 Medium 6.5 glpi Users emails enumeration 27.1%
• CVE-2023-51446 Medium 5.9 GLPI LDAP Injection during authentication 0.9%
• CVE-2024-23645 Medium 6.5 GLPI reflected XSS in reports pages 0.9%
• CVE-2023-46727 High 8.6 GLPI SQL injection through inventory agent request 67.7%
• CVE-2023-46726 High 7.2 GLPI Remote code execution from LDAP server configuration form on PHP 7.4 1.3%
• CVE-2023-43813 Medium 6.5 glpi Authenticated SQL Injection 30.9%
• CVE-2023-42802 Critical 10.0 GLPI vulnerable to unallowed PHP script execution 1.1%
• CVE-2023-42462 High 7.7 File deletion through document upload process in GLPI 1.3%
• CVE-2023-42461 Medium 6.5 SQL injection in ITIL actors in GLPI 1.2%
• CVE-2023-41888 Medium 5.3 Phishing through a login page malicious URL in GLPI 0.5%
• CVE-2023-41326 High 8.1 Account takeover via Kanban feature in GLPI 36.5%
• CVE-2023-41324 High 8.1 Account takeover through API in GLPI 0.9%