# cve.now: Glpi-project

The newest entries naming Glpi-project as an affected vendor (up to 200), of 188 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-53631](https://cve.now/CVE-2026-53631.md): GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds (CVSS 5.3)
- [CVE-2026-47678](https://cve.now/CVE-2026-47678.md): GLPI: Blind Time based SQLI in dropdowns (CVSS 8.7)
- [CVE-2026-52848](https://cve.now/CVE-2026-52848.md): GLPI: MFA bypass (CVSS 9.2)
- [CVE-2026-57152](https://cve.now/CVE-2026-57152.md): GLPI: Unallowed notifications sending (CVSS 7.1)
- [CVE-2026-121559](https://cve.now/CVE-2026-121559.md): GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning (CVSS 8.6)
- [CVE-2026-108726](https://cve.now/CVE-2026-108726.md): GLPI through 12.0.0 Missing Authorization via ajax/map.php (CVSS 5.3)
- [CVE-2026-53629](https://cve.now/CVE-2026-53629.md): GLPI: SQL injection in history tab (CVSS 7.1)
- [CVE-2026-53626](https://cve.now/CVE-2026-53626.md): GLPI: Arbitrary Document Read via Form Context Authorization Bypass (CVSS 7.1)
- [CVE-2026-48482](https://cve.now/CVE-2026-48482.md): GLPI: RCE via Form import (CVSS 9.4)
- [CVE-2026-53625](https://cve.now/CVE-2026-53625.md): GLPI: Privilege Escalation via authtype API manipulation (CVSS 7.5)
- [CVE-2026-53610](https://cve.now/CVE-2026-53610.md): GLPI: Reflected XSS in dashboards (CVSS 7.5)
- [CVE-2026-47679](https://cve.now/CVE-2026-47679.md): GLPI: arbitrary file deletion (CVSS 8.5)
- [CVE-2026-55214](https://cve.now/CVE-2026-55214.md): GLPI: Stored XSS in suppliers (CVSS 8.5)
- [CVE-2026-49470](https://cve.now/CVE-2026-49470.md): GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force (CVSS 7.7)
- [CVE-2026-55217](https://cve.now/CVE-2026-55217.md): GLPI: Unallowed modfication of knowbase items comments and translations (CVSS 5.3)
- [CVE-2026-53628](https://cve.now/CVE-2026-53628.md): GLPI: Unallowed authentication method update by administrator (CVSS 5.9)
- [CVE-2026-45801](https://cve.now/CVE-2026-45801.md): GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) (CVSS 5.3)
- [CVE-2026-53627](https://cve.now/CVE-2026-53627.md): GLPI: Unexpected access to update operations through the API (CVSS 6.0)
- [CVE-2026-49469](https://cve.now/CVE-2026-49469.md): GLPI: LDAP filter injection in user import feature (CVSS 4.6)
- [CVE-2026-13490](https://cve.now/CVE-2026-13490.md): glpi-project glpi Document document.send.php canViewFile authorization (CVSS 6.3)
- [CVE-2026-42321](https://cve.now/CVE-2026-42321.md): GLPI has stored XSS in asset locks (CVSS 8.4)
- [CVE-2026-42320](https://cve.now/CVE-2026-42320.md): GLPI vulnerable to arbitrary file access (CVSS 5.9)
- [CVE-2026-42318](https://cve.now/CVE-2026-42318.md): GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint (CVSS 7.0)
- [CVE-2026-42317](https://cve.now/CVE-2026-42317.md): GLPI vulnerable to arbitrary files deletion by technician (CVSS 7.0)
- [CVE-2026-44281](https://cve.now/CVE-2026-44281.md): GLPI vulnerable to unauthorized reading of a specific asset object (CVSS 7.0)
- [CVE-2026-40108](https://cve.now/CVE-2026-40108.md): GLPI Vulnerable to Stored XSS in ITIL Costs (CVSS 7.1)
- [CVE-2026-5385](https://cve.now/CVE-2026-5385.md): GLPI 11.0.0 - Stored XSS in knowledge base (CVSS 8.4)
- [CVE-2026-32312](https://cve.now/CVE-2026-32312.md): GLPI: Unauthorized export of form structure (CVSS 5.1)
- [CVE-2026-29047](https://cve.now/CVE-2026-29047.md): GLPI has an Authenticated SQL Injection via log exports (CVSS 7.2)
- [CVE-2026-26263](https://cve.now/CVE-2026-26263.md): GLPI has an Unauthenticated SQL Injection via Search engine (CVSS 8.1)
- [CVE-2026-26027](https://cve.now/CVE-2026-26027.md): GLPI has an Unauthenticated Stored XSS via inventory (CVSS 7.5)
- [CVE-2026-26026](https://cve.now/CVE-2026-26026.md): GLPI has a Server-Side Template Injection via Double-Compilation (CVSS 9.1)
- [CVE-2026-25932](https://cve.now/CVE-2026-25932.md): GLPI has Stored XSS in Supplier 'Website' field (CVSS 7.2)
- [CVE-2026-26001](https://cve.now/CVE-2026-26001.md): GLPI Inventory Plugin has SQL Injection on dropdown\_calendar Report (CVSS 7.1)
- [CVE-2026-25937](https://cve.now/CVE-2026-25937.md): GLPI has a MFA bypass (CVSS 6.5)
- [CVE-2026-25936](https://cve.now/CVE-2026-25936.md): GLPI Vulnerable to Authenticated SQL Injection (CVSS 6.5)
- [CVE-2026-22248](https://cve.now/CVE-2026-22248.md): GLPI affected by Remote Code Execution via malicious upload (CVSS 8.1)
- [CVE-2026-25590](https://cve.now/CVE-2026-25590.md): GLPI Inventory Plugin has Reflected XSS in task jobs (CVSS 4.5)
- [CVE-2026-22044](https://cve.now/CVE-2026-22044.md): GLPI is Vulnerable to Authenticated SQL Injection (CVSS 6.5)
- [CVE-2026-23624](https://cve.now/CVE-2026-23624.md): GLPI is vulnerable to session stealing on externally authenticated user change (CVSS 4.3)
- [CVE-2026-22247](https://cve.now/CVE-2026-22247.md): GLPI is Vulnerable to SSRF via Webhooks (CVSS 4.1)
- [CVE-2025-66417](https://cve.now/CVE-2025-66417.md): GLPI has an unauthenticated SQL injection through the inventory endpoint (CVSS 7.5)
- [CVE-2025-64516](https://cve.now/CVE-2025-64516.md): GLPI incorrectly authorizes access to documents (CVSS 7.5)
- [CVE-2023-53943](https://cve.now/CVE-2023-53943.md): GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint (CVSS 6.9)
- [CVE-2025-64520](https://cve.now/CVE-2025-64520.md): GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API (CVSS 6.5)
- [CVE-2025-59935](https://cve.now/CVE-2025-59935.md): GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page (CVSS 6.5)
- [CVE-2025-32786](https://cve.now/CVE-2025-32786.md): GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2025-53105](https://cve.now/CVE-2025-53105.md): GLPI permits unauthorized rules execution order (CVSS 7.5)
- [CVE-2025-53357](https://cve.now/CVE-2025-53357.md): GLPI permits reservation modification by unauthorized users (CVSS 5.4)
- [CVE-2025-53113](https://cve.now/CVE-2025-53113.md): GLPI technicians can access unauthorized information through external links (CVSS 2.7)
- [CVE-2025-53112](https://cve.now/CVE-2025-53112.md): GLPI's incomprehensive permission checks can lead to data removal from allowed users (CVSS 4.3)
- [CVE-2025-53111](https://cve.now/CVE-2025-53111.md): GLPI exposes data to non-allowed users (CVSS 6.5)
- [CVE-2025-53008](https://cve.now/CVE-2025-53008.md): GLPI's MailCollector Receiver is vulnerable to credential exfiltration (CVSS 6.5)
- [CVE-2025-52897](https://cve.now/CVE-2025-52897.md): GLPI is vulnerable to XSS and open redirection attacks through planning feature (CVSS 6.5)
- [CVE-2025-52567](https://cve.now/CVE-2025-52567.md): GLPI has overly permissive URL verification (CVSS 3.5)
- [CVE-2025-27514](https://cve.now/CVE-2025-27514.md): GLPI is susceptible to Stored XSS attack through project's kanban (CVSS 4.5)
- [CVE-2025-27147](https://cve.now/CVE-2025-27147.md): GLPI Inventory plugin has Improper Access Control Vulnerability (CVSS 8.2)
- [CVE-2025-24801](https://cve.now/CVE-2025-24801.md): GLPI allows authenticated remote code execution (CVSS 8.6)
- [CVE-2025-24799](https://cve.now/CVE-2025-24799.md): GLPI allows unauthenticated SQL injection through the inventory endpoint (CVSS 7.5)
- [CVE-2025-21619](https://cve.now/CVE-2025-21619.md): GLPI allows SQL injection through the rules configuration (CVSS 8.2)
- [CVE-2025-26626](https://cve.now/CVE-2025-26626.md): GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting (CVSS 6.5)
- [CVE-2025-25192](https://cve.now/CVE-2025-25192.md): GLPI allows unauthorized access to debug mode (CVSS 6.5)
- [CVE-2025-23046](https://cve.now/CVE-2025-23046.md): GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin (CVSS 6.3)
- [CVE-2025-23024](https://cve.now/CVE-2025-23024.md): GLPI: Plugins are disabled accessing one page (CVSS 6.9)
- [CVE-2025-21627](https://cve.now/CVE-2025-21627.md): GLPI Cross-site Scripting vulnerability (CVSS 6.5)
- [CVE-2025-21626](https://cve.now/CVE-2025-21626.md): GLPI vulnerable to exposure of sensitive information in the \`status.php\` endpoint (CVSS 5.8)
- [CVE-2024-50339](https://cve.now/CVE-2024-50339.md): GLPI vulnerable to unauthenticated session hijacking (CVSS 9.3)
- [CVE-2024-48912](https://cve.now/CVE-2024-48912.md): GLPI vulnerable to authenticated insecure account deletion (CVSS 7.2)
- [CVE-2024-47761](https://cve.now/CVE-2024-47761.md): GLPI vulnerable to account takeover via the password reset feature (CVSS 7.5)
- [CVE-2024-47760](https://cve.now/CVE-2024-47760.md): GLPI vulnerable to account takeover via API (CVSS 7.5)
- [CVE-2024-47758](https://cve.now/CVE-2024-47758.md): GLPI vulnerable to account takeover without privilege escalation through the API (CVSS 7.6)
- [CVE-2024-43416](https://cve.now/CVE-2024-43416.md): GLPI vulnerable to enumeration of users' email addresses by unauthenticated user (CVSS 7.5)
- [CVE-2024-38370](https://cve.now/CVE-2024-38370.md): GLPI allows API document download without rights (CVSS 5.3)
- [CVE-2024-45611](https://cve.now/CVE-2024-45611.md): GLPI has a stored XSS at src/RSSFeed.php (CVSS 5.7)
- [CVE-2024-45610](https://cve.now/CVE-2024-45610.md): GLPI has a reflected XSS in ajax/cable.php (CVSS 6.5)
- [CVE-2024-45609](https://cve.now/CVE-2024-45609.md): GLPI has a Reflected XSS in /front/stat.graph.php (CVSS 6.5)
- [CVE-2024-45608](https://cve.now/CVE-2024-45608.md): GLPI has an Authenticated SQL Injection (CVSS 6.5)
- [CVE-2024-43418](https://cve.now/CVE-2024-43418.md): GLPI has multiple reflected XSS (CVSS 6.5)
- [CVE-2024-43417](https://cve.now/CVE-2024-43417.md): Reflected XSS in Software form (CVSS 6.5)
- [CVE-2024-41679](https://cve.now/CVE-2024-41679.md): Authenticated SQL injection in ticket form (CVSS 6.5)
- [CVE-2024-41678](https://cve.now/CVE-2024-41678.md): GLPI has multiple reflected XSS (CVSS 6.5)
- [CVE-2024-40638](https://cve.now/CVE-2024-40638.md): GLPI allows account takeover via SQL Injection in AJAX scripts (CVSS 8.1)
- [CVE-2024-47759](https://cve.now/CVE-2024-47759.md): GLPI has a stored XSS via document upload (CVSS 6.7)
- [CVE-2024-37149](https://cve.now/CVE-2024-37149.md): GLPI allows remote code execution through the plugin loader (CVSS 7.2)
- [CVE-2024-37148](https://cve.now/CVE-2024-37148.md): GLPI allows account takeover via SQL Injection in AJAX scripts (CVSS 8.1)
- [CVE-2024-37147](https://cve.now/CVE-2024-37147.md): GLPI allows Authenticated File Upload to Restricted Tickets (CVSS 4.3)
- [CVE-2024-31456](https://cve.now/CVE-2024-31456.md): GLPI contains an authenticated SQL injection (CVSS 7.7)
- [CVE-2024-29889](https://cve.now/CVE-2024-29889.md): GLPI contains an SQL injection through the saved searches (CVSS 7.1)
- [CVE-2024-28241](https://cve.now/CVE-2024-28241.md): GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder (CVSS 7.3)
- [CVE-2024-28240](https://cve.now/CVE-2024-28240.md): GLPI-Agent's MSI package installation permits local users to change Agent configuration (CVSS 7.3)
- [CVE-2024-27914](https://cve.now/CVE-2024-27914.md): Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI (CVSS 5.3)
- [CVE-2024-27104](https://cve.now/CVE-2024-27104.md): Stored XSS in dashboards in GLPI (CVSS 4.5)
- [CVE-2024-27098](https://cve.now/CVE-2024-27098.md): Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI (CVSS 6.4)
- [CVE-2024-27096](https://cve.now/CVE-2024-27096.md): SQL Injection in through the search engine (CVSS 7.7)
- [CVE-2024-27930](https://cve.now/CVE-2024-27930.md): Sensitive fields access through dropdowns in GLPI (CVSS 6.5)
- [CVE-2024-27937](https://cve.now/CVE-2024-27937.md): glpi Users emails enumeration (CVSS 6.5)
- [CVE-2023-51446](https://cve.now/CVE-2023-51446.md): GLPI LDAP Injection during authentication (CVSS 5.9)
- [CVE-2024-23645](https://cve.now/CVE-2024-23645.md): GLPI reflected XSS in reports pages (CVSS 6.5)
- [CVE-2023-46727](https://cve.now/CVE-2023-46727.md): GLPI SQL injection through inventory agent request (CVSS 8.6)
- [CVE-2023-46726](https://cve.now/CVE-2023-46726.md): GLPI Remote code execution from LDAP server configuration form on PHP 7.4 (CVSS 7.2)
- [CVE-2023-43813](https://cve.now/CVE-2023-43813.md): glpi Authenticated SQL Injection (CVSS 6.5)
- [CVE-2023-42802](https://cve.now/CVE-2023-42802.md): GLPI vulnerable to unallowed PHP script execution (CVSS 10.0)
- [CVE-2023-42462](https://cve.now/CVE-2023-42462.md): File deletion through document upload process in GLPI (CVSS 7.7)
- [CVE-2023-42461](https://cve.now/CVE-2023-42461.md): SQL injection in ITIL actors in GLPI (CVSS 6.5)
- [CVE-2023-41888](https://cve.now/CVE-2023-41888.md): Phishing through a login page malicious URL in GLPI (CVSS 5.3)
- [CVE-2023-41326](https://cve.now/CVE-2023-41326.md): Account takeover via Kanban feature in GLPI (CVSS 8.1)
- [CVE-2023-41324](https://cve.now/CVE-2023-41324.md): Account takeover through API in GLPI (CVSS 8.1)
- [CVE-2023-41323](https://cve.now/CVE-2023-41323.md): Users login enumeration by unauthenticated user in GLPI (CVSS 5.3)
- [CVE-2023-41322](https://cve.now/CVE-2023-41322.md): Privilege Escalation from technician to super-admin in GLPI (CVSS 4.9)
- [CVE-2023-41321](https://cve.now/CVE-2023-41321.md): Sensitive fields enumeration through API in GLPI (CVSS 4.9)
- [CVE-2023-41320](https://cve.now/CVE-2023-41320.md): Account takeover via SQL Injection in UI layout preferences in GLPI (CVSS 8.1)
- [CVE-2023-37278](https://cve.now/CVE-2023-37278.md): GLPI vulnerable to SQL injection via dashboard administration (CVSS 6.8)
- [CVE-2023-36808](https://cve.now/CVE-2023-36808.md): GLPI vulnerable to SQL injection through Computer Virtual Machine information (CVSS 8.6)
- [CVE-2023-35940](https://cve.now/CVE-2023-35940.md): GLPI vulnerable to unauthenticated access to Dashboard data (CVSS 7.5)
- [CVE-2023-35939](https://cve.now/CVE-2023-35939.md): GLPI vulnerable to unauthorized access to Dashboard data (CVSS 8.1)
- [CVE-2023-35924](https://cve.now/CVE-2023-35924.md): GLPI vulnerable to SQL injection via inventory agent request (CVSS 8.6)
- [CVE-2023-34244](https://cve.now/CVE-2023-34244.md): GLPI vulnerable to reflected XSS in search pages (CVSS 6.5)
- [CVE-2023-34107](https://cve.now/CVE-2023-34107.md): GLPI vulnerable to unauthorized access to KnowbaseItem data (CVSS 6.5)
- [CVE-2023-34106](https://cve.now/CVE-2023-34106.md): GLPI vulnerable to unauthorized access to User data (CVSS 6.5)
- [CVE-2023-34254](https://cve.now/CVE-2023-34254.md): Remote inventory task command injection when using ssh command mode (CVSS 7.7)
- [CVE-2023-28852](https://cve.now/CVE-2023-28852.md): GLPI vulnerable to stored Cross-site Scripting through dashboard administration (CVSS 4.8)
- [CVE-2023-28849](https://cve.now/CVE-2023-28849.md): GLPI vulnerable to SQL injection and Stored XSS via inventory agent request (CVSS 10.0)
- [CVE-2023-28838](https://cve.now/CVE-2023-28838.md): GLPI vulnerable to SQL injection through dynamic reports (CVSS 9.6)
- [CVE-2023-28636](https://cve.now/CVE-2023-28636.md): GLPI vulnerable to stored Cross-site Scripting in external links (CVSS 4.5)
- [CVE-2023-28634](https://cve.now/CVE-2023-28634.md): GLPI vulnerable to Privilege Escalation from Technician to Super-Admin (CVSS 8.8)
- [CVE-2023-28633](https://cve.now/CVE-2023-28633.md): GLPI vulnerable to Blind Server-Side Request Forgery (SSRF) in RSS feeds (CVSS 3.5)
- [CVE-2023-28632](https://cve.now/CVE-2023-28632.md): GLPI vulnerable to account takeover by authenticated user (CVSS 8.1)
- [CVE-2022-41941](https://cve.now/CVE-2022-41941.md): glpi contains XSS Stored inside Standard Interface Help Link href attribute (CVSS 6.2)
- [CVE-2023-22500](https://cve.now/CVE-2023-22500.md): glpi Unauthorized access to inventory files (CVSS 7.5)
- [CVE-2023-22722](https://cve.now/CVE-2023-22722.md): glpi subject to Cross-site Scripting (XSS) - Reflected (CVSS 6.8)
- [CVE-2023-22724](https://cve.now/CVE-2023-22724.md): glpi contains XSS in RSS Description Link (CVSS 6.2)
- [CVE-2023-22725](https://cve.now/CVE-2023-22725.md): glpi vulnerable to XSS on external links (CVSS 6.2)
- [CVE-2023-23610](https://cve.now/CVE-2023-23610.md): glpi vulnerable to Unauthorized access to data export (CVSS 6.5)
- [CVE-2022-39376](https://cve.now/CVE-2022-39376.md): Improper input validation on emails links in GLPI (CVSS 2.6)
- [CVE-2022-39375](https://cve.now/CVE-2022-39375.md): Cross-Site Scripting (XSS) through public RSS feed in GLPI (CVSS 4.5)
- [CVE-2022-39373](https://cve.now/CVE-2022-39373.md): Stored Cross-Site Scripting (XSS) in entity name in GLPI (CVSS 4.9)
- [CVE-2022-39372](https://cve.now/CVE-2022-39372.md): Stored Cross-Site Scripting (XSS) in user information in GLPI (CVSS 3.5)
- [CVE-2022-39371](https://cve.now/CVE-2022-39371.md): Stored Cross-Site Scripting (XSS) through asset inventory in GLPI (CVSS 7.5)
- [CVE-2022-39370](https://cve.now/CVE-2022-39370.md): Improper access to debug panel in GLPI (CVSS 4.3)
- [CVE-2022-39323](https://cve.now/CVE-2022-39323.md): SQL Injection on REST API in GLPI (CVSS 7.4)
- [CVE-2022-39277](https://cve.now/CVE-2022-39277.md): Cross-Site Scripting (XSS) in external links in GLPI (CVSS 4.5)
- [CVE-2022-39276](https://cve.now/CVE-2022-39276.md): Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning (CVSS 3.5)
- [CVE-2022-39262](https://cve.now/CVE-2022-39262.md): Stored Cross-Site Scripting (XSS) on login page in GLPI (CVSS 5.2)
- [CVE-2022-39234](https://cve.now/CVE-2022-39234.md): user session persists even after permanently deleting account in GLPI (CVSS 4.7)
- [CVE-2022-31187](https://cve.now/CVE-2022-31187.md): Stored Cross Site Scripting (XSS) through global search in GLPI (CVSS 6.8)
- [CVE-2022-35946](https://cve.now/CVE-2022-35946.md): SQL injection through plugin controller in GLPI (CVSS 5.5)
- [CVE-2022-35947](https://cve.now/CVE-2022-35947.md): SQL injection in GLPI (CVSS 10.0)
- [CVE-2022-36112](https://cve.now/CVE-2022-36112.md): Blind Server-Side Request Forgery (SSRF) in GLPI (CVSS 3.5)
- [CVE-2022-35945](https://cve.now/CVE-2022-35945.md): Cross site scripting (XSS) via registration API in GLPI (CVSS 6.3)
- [CVE-2022-31143](https://cve.now/CVE-2022-31143.md): Leak of sensitive information through login page error in GLPI (CVSS 5.3)
- [CVE-2022-31061](https://cve.now/CVE-2022-31061.md): SQL injection on login page in GLPI (CVSS 9.8)
- [CVE-2022-31068](https://cve.now/CVE-2022-31068.md): Sensitive Data Exposure on Refused Inventory Files in GLPI (CVSS 5.3)
- [CVE-2022-31056](https://cve.now/CVE-2022-31056.md): SQL injection with \_actor parameter in GLPI (CVSS 9.8)
- [CVE-2022-31082](https://cve.now/CVE-2022-31082.md): SQL Injection via package deployment tasks in glpi-inventory-plugin (CVSS 5.8)
- [CVE-2022-31062](https://cve.now/CVE-2022-31062.md): Unauthenticated Local File Inclusion (CVSS 5.3)
- [CVE-2022-29250](https://cve.now/CVE-2022-29250.md): SQL injection in GLPI (CVSS 8.1)
- [CVE-2022-24876](https://cve.now/CVE-2022-24876.md): Stored cross site scrpting in GLPI's Kanban (CVSS 5.4)
- [CVE-2022-24869](https://cve.now/CVE-2022-24869.md): Cross Site Scripting in GLPI (CVSS 4.6)
- [CVE-2022-24868](https://cve.now/CVE-2022-24868.md): Cross site scripting via SVG file upload in GLPI (CVSS 7.3)
- [CVE-2022-24867](https://cve.now/CVE-2022-24867.md): LDAP password exposure in glpi (CVSS 7.5)
- [CVE-2021-39213](https://cve.now/CVE-2021-39213.md): IP restriction on GLPI API Bypass with custom header injection (CVSS 6.8)
- [CVE-2021-39211](https://cve.now/CVE-2021-39211.md): Disclosure of GLPI and server information in telemetry endpoint (CVSS 5.3)
- [CVE-2021-39210](https://cve.now/CVE-2021-39210.md): Autologin cookie accessible by scripts (CVSS 6.5)
- [CVE-2021-39209](https://cve.now/CVE-2021-39209.md): Bypassable CSRF protection (CVSS 8.8)
- [CVE-2021-21324](https://cve.now/CVE-2021-21324.md): Insecure Direct Object Reference (IDOR) on "Solutions" (CVSS 6.8)
- [CVE-2021-21325](https://cve.now/CVE-2021-21325.md): Stored XSS in budget type (CVSS 6.2)
- [CVE-2021-21326](https://cve.now/CVE-2021-21326.md): Horizontal Privilege Escalation (CVSS 7.7)
- [CVE-2021-21327](https://cve.now/CVE-2021-21327.md): Unsafe Reflection in getItemForItemtype() (CVSS 6.8)
- [CVE-2021-21314](https://cve.now/CVE-2021-21314.md): XSS injection on ticket update (CVSS 5.4)
- [CVE-2021-21312](https://cve.now/CVE-2021-21312.md): Stored XSS on documents (CVSS 5.4)
- [CVE-2021-21313](https://cve.now/CVE-2021-21313.md): XSS on tabs (CVSS 4.9)
- [CVE-2021-21258](https://cve.now/CVE-2021-21258.md): XSS injection in ajax/kanban (CVSS 6.8)
- [CVE-2021-21255](https://cve.now/CVE-2021-21255.md): entities switch IDOR (CVSS 5.8)
- [CVE-2020-26212](https://cve.now/CVE-2020-26212.md): Any GLPI CalDAV calendars is read-only for every authenticated user (CVSS 7.7)
- [CVE-2020-15226](https://cve.now/CVE-2020-15226.md): SQL Injection in GLPI Search API (CVSS 5.0)
- [CVE-2020-15217](https://cve.now/CVE-2020-15217.md): User data exposure in GLPI (CVSS 5.3)
- [CVE-2020-15177](https://cve.now/CVE-2020-15177.md): Unauthenticated Stored XSS in GLPI (CVSS 8.0)
- [CVE-2020-15176](https://cve.now/CVE-2020-15176.md): SQL injection in GLPI (CVSS 8.7)
- [CVE-2020-15175](https://cve.now/CVE-2020-15175.md): Unauthenticated File Deletion in GLPI (CVSS 7.4)
- [CVE-2020-11031](https://cve.now/CVE-2020-11031.md): Insecure encryption algorithm in GLPI (CVSS 7.8)
- [CVE-2020-15108](https://cve.now/CVE-2020-15108.md): SQL Injection in glpi (CVSS 7.1)
- [CVE-2020-11060](https://cve.now/CVE-2020-11060.md): Remote Code Execution in GLPI (CVSS 7.4)
- [CVE-2020-5248](https://cve.now/CVE-2020-5248.md): Public GLPIKEY can be used to decrypt any data in GLPI (CVSS 7.2)
- [CVE-2020-11036](https://cve.now/CVE-2020-11036.md): XSS in GLPI (CVSS 7.6)
- [CVE-2020-11035](https://cve.now/CVE-2020-11035.md): weak CSRF tokens in GLPI (CVSS 7.5)
- [CVE-2020-11034](https://cve.now/CVE-2020-11034.md): bypass of manageRedirect in GLPI (CVSS 6.1)
- [CVE-2020-11033](https://cve.now/CVE-2020-11033.md): Able to read any token through API user endpoint in GLPI (CVSS 6.6)
- [CVE-2020-11032](https://cve.now/CVE-2020-11032.md): SQL injection on addme\_observer and addme\_assign in GLPI (CVSS 7.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/glpi-project
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.