Glpi-project Glpi
201 CVEs affecting Glpi-project Glpi. Latest disclosed: 2026-06-28. Critical: 13, High: 63.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-42802 | Critical | 10.0 | 2023-11-02 | GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one… |
CVE-2023-28849 | Critical | 10.0 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a… |
CVE-2022-35947 | Critical | 10.0 | 2022-09-14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licen… |
CVE-2025-21619 | Critical | 9.8 | 2025-03-18 | GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerabi… |
CVE-2022-35914 | Critical | 9.8 | 2022-09-19 | /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. |
CVE-2022-31061 | Critical | 9.8 | 2022-06-28 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versio… |
CVE-2022-31056 | Critical | 9.8 | 2022-06-28 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versio… |
CVE-2021-44617 | Critical | 9.8 | 2022-03-28 | A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated. |
CVE-2017-11184 | Critical | 9.8 | 2017-07-28 | SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter. |
CVE-2017-11474 | Critical | 9.8 | 2017-07-20 | GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php. |
CVE-2017-11329 | Critical | 9.8 | 2017-07-17 | GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers. |
CVE-2023-28838 | Critical | 9.6 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow… |
CVE-2026-26026 | Critical | 9.1 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability i… |
CVE-2024-47760 | High | 8.8 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can tak… |
CVE-2024-47758 | High | 8.8 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take… |
CVE-2024-27756 | High | 8.8 | 2024-03-15 | GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. |
CVE-2023-28634 | High | 8.8 | 2023-04-05 | GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profil… |
CVE-2021-39209 | High | 8.8 | 2021-09-15 | GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSR… |
CVE-2019-14666 | High | 8.8 | 2019-09-25 | GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery… |
CVE-2018-13049 | High | 8.8 | 2018-07-02 | The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to fro… |