Skip to content
PpluginsGLPI
Products
| Product | CVEs | Exploited | Latest |
|---|
| fields | 3 | – | Mar 16, 2026 |
| databaseinventory | 2 | – | Dec 19, 2025 |
| addressing | 2 | – | Dec 26, 2024 |
| datainjection | 1 | – | Jul 10, 2026 |
| escalade | 1 | – | Jul 1, 2025 |
| barcode | 1 | – | Nov 24, 2021 |
| formcreator | 1 | – | May 31, 2023 |
| mreporting | 1 | – | Feb 12, 2026 |
| order | 1 | – | Apr 5, 2023 |
| sccm | 1 | – | Sep 22, 2022 |
| tag | 1 | – | Jul 9, 2026 |
Exploited and recent CVEs
-
CVE-2026-11321
Medium 6.4
GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import
0.4%
-
CVE-2026-53987
Medium 6.4
Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering
0.5%
-
CVE-2026-23489
Critical 9.1
Fields GLPI plugin vulnerable to RCE in dropdown generation
0.3%
-
CVE-2026-22821
Medium 4.9
mreporting affected by a SQLI on date change
0.3%
-
CVE-2025-65035
Medium 6.4
GLPI Database Inventory Plugin Vulnerable to Stored Object Injection
0.3%
-
CVE-2025-53360
Medium 4.3
pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests
0.3%
-
CVE-2025-27153
Medium 6.5
Escalade GLPI Plugin Vulnerable to Improper Access Control
0.3%
-
CVE-2024-53850
High 8.2
The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation
0.5%
-
CVE-2024-45600
High 7.7
Fields GLPI plugin has an Authenticated SQL Injection
0.5%
-
CVE-2023-33971
Medium 6.1
Formcreator vulnerable to stored XSS from ##FULLFORM##
0.6%
-
CVE-2023-29006
High 8.8
Order GLPI plugin vulnerable to remote code execution from authenticated user
0.9%
-
CVE-2023-28855
Medium 6.5
Fields GLPI plugin vulnerable to unauthorized write access to additional fields
0.6%
-
CVE-2021-39190
Medium 5.3
SCCM plugin for GLPI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
0.6%
-
CVE-2021-43779
Critical 9.9
Remote Command Execution vulnerability
9.1%
-
CVE-2021-43778
Critical 9.1
Path traversal in GLPI barcode plugin
52.7%