Glpi-project vulnerabilities
188 CVEs and advisories name Glpi-project as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-53631GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds
- CVE-2026-47678GLPI: Blind Time based SQLI in dropdowns
- CVE-2026-52848GLPI: MFA bypass
- CVE-2026-57152GLPI: Unallowed notifications sending
- CVE-2026-121559GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning
- CVE-2026-108726GLPI through 12.0.0 Missing Authorization via ajax/map.php
- CVE-2026-53629GLPI: SQL injection in history tab
- CVE-2026-53626GLPI: Arbitrary Document Read via Form Context Authorization Bypass
- CVE-2026-48482GLPI: RCE via Form import
- CVE-2026-53625GLPI: Privilege Escalation via authtype API manipulation
- CVE-2026-53610GLPI: Reflected XSS in dashboards
- CVE-2026-47679GLPI: arbitrary file deletion
- CVE-2026-55214GLPI: Stored XSS in suppliers
- CVE-2026-49470GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force
- CVE-2026-55217GLPI: Unallowed modfication of knowbase items comments and translations
- CVE-2026-53628GLPI: Unallowed authentication method update by administrator
- CVE-2026-45801GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)
- CVE-2026-53627GLPI: Unexpected access to update operations through the API
- CVE-2026-49469GLPI: LDAP filter injection in user import feature
- CVE-2026-13490glpi-project glpi Document document.send.php canViewFile authorization
- CVE-2026-42321GLPI has stored XSS in asset locks
- CVE-2026-42320GLPI vulnerable to arbitrary file access
- CVE-2026-42318GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint
- CVE-2026-42317GLPI vulnerable to arbitrary files deletion by technician
- CVE-2026-44281GLPI vulnerable to unauthorized reading of a specific asset object
- CVE-2026-40108GLPI Vulnerable to Stored XSS in ITIL Costs
- CVE-2026-5385GLPI 11.0.0 - Stored XSS in knowledge base
- CVE-2026-32312GLPI: Unauthorized export of form structure
- CVE-2026-29047GLPI has an Authenticated SQL Injection via log exports
- CVE-2026-26263GLPI has an Unauthenticated SQL Injection via Search engine