Glpi-project vulnerabilities
188 CVEs and advisories name Glpi-project as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-26626GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting
- CVE-2025-25192GLPI allows unauthorized access to debug mode
- CVE-2025-23046GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin
- CVE-2025-23024GLPI: Plugins are disabled accessing one page
- CVE-2025-21627GLPI Cross-site Scripting vulnerability
- CVE-2025-21626GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint
- CVE-2024-50339GLPI vulnerable to unauthenticated session hijacking
- CVE-2024-48912GLPI vulnerable to authenticated insecure account deletion
- CVE-2024-47761GLPI vulnerable to account takeover via the password reset feature
- CVE-2024-47760GLPI vulnerable to account takeover via API
- CVE-2024-47758GLPI vulnerable to account takeover without privilege escalation through the API
- CVE-2024-43416GLPI vulnerable to enumeration of users' email addresses by unauthenticated user
- CVE-2024-38370GLPI allows API document download without rights
- CVE-2024-45611GLPI has a stored XSS at src/RSSFeed.php
- CVE-2024-45610GLPI has a reflected XSS in ajax/cable.php
- CVE-2024-45609GLPI has a Reflected XSS in /front/stat.graph.php
- CVE-2024-45608GLPI has an Authenticated SQL Injection
- CVE-2024-43418GLPI has multiple reflected XSS
- CVE-2024-43417Reflected XSS in Software form
- CVE-2024-41679Authenticated SQL injection in ticket form
- CVE-2024-41678GLPI has multiple reflected XSS
- CVE-2024-40638GLPI allows account takeover via SQL Injection in AJAX scripts
- CVE-2024-47759GLPI has a stored XSS via document upload
- CVE-2024-37149GLPI allows remote code execution through the plugin loader
- CVE-2024-37148GLPI allows account takeover via SQL Injection in AJAX scripts
- CVE-2024-37147GLPI allows Authenticated File Upload to Restricted Tickets
- CVE-2024-31456GLPI contains an authenticated SQL injection
- CVE-2024-29889GLPI contains an SQL injection through the saved searches
- CVE-2024-28241GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder
- CVE-2024-28240GLPI-Agent's MSI package installation permits local users to change Agent configuration