Pluginsglpi
13 CVEs across 11 Pluginsglpi products. Browse Pluginsglpi vulnerabilities, severities, and proof-of-concept exploits.
Pluginsglpi products with known CVEs
Pluginsglpi CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-11321 | Medium | 6.4 | 2026-07-10 | The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without para… |
CVE-2026-53987 | Medium | 6.4 | 2026-07-09 | The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanC… |
CVE-2026-23489 | Critical | 9.1 | 2026-03-16 | Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from… |
CVE-2026-22821 | Medium | 4.9 | 2026-02-12 | mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4. |
CVE-2025-65035 | Medium | 6.4 | 2025-12-19 | pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Pr… |
CVE-2025-53360 | Medium | 4.3 | 2025-11-18 | pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. In… |
CVE-2025-27153 | Medium | 6.5 | 2025-07-01 | Escalade GLPI plugin is a ticket escalation process helper for GLPI. Prior to version 2.9.11, there is an improper access control vulnerability. This can lead… |
CVE-2024-53850 | High | 8.2 | 2024-12-26 | The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network.. Starting with 3.0.0 and before 3.0.3… |
CVE-2024-45600 | High | 7.7 | 2024-12-26 | Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when th… |
CVE-2023-33971 | Medium | 6.1 | 2023-05-31 | Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probable stored cross-site… |
CVE-2023-29006 | High | 8.8 | 2023-04-05 | The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated… |
CVE-2023-28855 | Medium | 6.5 | 2023-04-05 | Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows an… |
CVE-2021-39190 | Medium | 5.3 | 2022-09-22 | The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuration page is publicly… |
CVE-2021-43779 | Critical | 9.9 | 2022-01-05 | GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenti… |
CVE-2021-43778 | Critical | 9.1 | 2021-11-24 | Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable… |