Glpi-project vulnerabilities
188 CVEs and advisories name Glpi-project as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-26027GLPI has an Unauthenticated Stored XSS via inventory
- CVE-2026-26026GLPI has a Server-Side Template Injection via Double-Compilation
- CVE-2026-25932GLPI has Stored XSS in Supplier 'Website' field
- CVE-2026-26001GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report
- CVE-2026-25937GLPI has a MFA bypass
- CVE-2026-25936GLPI Vulnerable to Authenticated SQL Injection
- CVE-2026-22248GLPI affected by Remote Code Execution via malicious upload
- CVE-2026-25590GLPI Inventory Plugin has Reflected XSS in task jobs
- CVE-2026-22044GLPI is Vulnerable to Authenticated SQL Injection
- CVE-2026-23624GLPI is vulnerable to session stealing on externally authenticated user change
- CVE-2026-22247GLPI is Vulnerable to SSRF via Webhooks
- CVE-2025-66417GLPI has an unauthenticated SQL injection through the inventory endpoint
- CVE-2025-64516GLPI incorrectly authorizes access to documents
- CVE-2023-53943GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint
- CVE-2025-64520GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API
- CVE-2025-59935GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page
- CVE-2025-32786GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection
- CVE-2025-53105GLPI permits unauthorized rules execution order
- CVE-2025-53357GLPI permits reservation modification by unauthorized users
- CVE-2025-53113GLPI technicians can access unauthorized information through external links
- CVE-2025-53112GLPI's incomprehensive permission checks can lead to data removal from allowed users
- CVE-2025-53111GLPI exposes data to non-allowed users
- CVE-2025-53008GLPI's MailCollector Receiver is vulnerable to credential exfiltration
- CVE-2025-52897GLPI is vulnerable to XSS and open redirection attacks through planning feature
- CVE-2025-52567GLPI has overly permissive URL verification
- CVE-2025-27514GLPI is susceptible to Stored XSS attack through project's kanban
- CVE-2025-27147GLPI Inventory plugin has Improper Access Control Vulnerability
- CVE-2025-24801GLPI allows authenticated remote code execution
- CVE-2025-24799GLPI allows unauthenticated SQL injection through the inventory endpoint
- CVE-2025-21619GLPI allows SQL injection through the rules configuration