glpi vulnerabilities | LiveThreat CVE Feed

Product

glpi

by glpi-project · last CVE Oct 11, 2026

On CISA KEVExploited in the wild

213

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities213 In the news0 Timeline

Severity mix

Critical 27High 63Medium 108Low 3

Severity

All severities213 Critical27 High63 Medium108 Low3

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add glpi to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2022-35914 In wildKEV	9.8	100%	Sep 19	Teclib GLPI Remote Code Execution Vulnerability Affected: through 10.0.2
CVE-2026-26263	9.8	8%	Apr 6	GLPI has an Unauthenticated SQL Injection via Search engine Affected: >= 11.0.0, < 11.0.6
CVE-2025-66417	9.8	0%	Jan 15	GLPI has an unauthenticated SQL injection through the inventory endpoint Affected: >= 11.0.0, < 11.0.3
CVE-2025-24799	9.8	87%	Mar 18	GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.18
CVE-2025-21619	9.8	0%	Mar 18	GLPI is a free asset and IT management software package Affected: 0.78 before 10.0.18
CVE-2023-46727	9.8	68%	Dec 13	GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.11
CVE-2023-46726	9.8	1%	Dec 13	GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.11
CVE-2023-42802	9.8	1%	Nov 2	GLPI is a free asset and IT management software package Affected: 10.0.7 before 10.0.10
CVE-2023-42461	9.8	1%	Sep 27	GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 10.0.0 before 10.0.10
CVE-2023-41320	9.8	36%	Sep 27	GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 10.0.0 before 10.0.10
CVE-2023-36808	9.8	52%	Jul 5	GLPI is a free asset and IT management software package Affected: 0.80 before 10.0.8
CVE-2023-35924	9.8	52%	Jul 5	GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.8
CVE-2022-39323	9.8	37%	Nov 3	SQL Injection on REST API in GLPI Affected: < 10.0.4
CVE-2022-35947	9.8	1%	Sep 14	GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 10.0.3
CVE-2022-31061	9.8	51%	Jun 28	GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 9.3.0 before 9.5.8; 10.0.0 before 10.0.2
CVE-2022-31056	9.8	10%	Jun 28	GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 10.0.0 before 10.0.2
CVE-2021-44617	9.8	2%	Mar 28	A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated Affected: 9.4.6
CVE-2017-11184	9.8	2%	Jul 28	SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter Affected: through 9.1.4
CVE-2017-11474	9.8	2%	Jul 20	GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php Affected: through 9.1.5.0
CVE-2017-11329	9.8	1%	Jul 17	GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers Affected: through 9.1.4
CVE-2024-27098	9.6	36%	Mar 18	GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 9.5.0 before 10.0.13
CVE-2026-48482	9.4	0%	Sep 25	GLPI: RCE via Form import Affected: >= 11.0.0, < 11.0.8
CVE-2020-11035	9.3	1%	May 5	In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm Affected: 0.83.3 before 9.4.6
CVE-2026-22247	9.1	0%	Feb 4	GLPI is Vulnerable to SSRF via Webhooks Affected: >= 11.0.0, < 11.0.5
CVE-2023-42462	9.1	1%	Sep 27	GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 10.0.0 before 10.0.10
CVE-2023-37278	9.1	1%	Jul 13	GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: before 10.0.9
CVE-2020-15175	9.1	70%	Oct 7	In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin Affected: before 9.5.2
CVE-2026-29047	8.8	0%	Apr 6	GLPI has an Authenticated SQL Injection via log exports Affected: >= 10.0.0, 10.0.24; >= 11.0.0-alpha, < 11.0.6
CVE-2026-25936	8.8	0%	Mar 17	GLPI Vulnerable to Authenticated SQL Injection Affected: >= 11.0.0, < 11.0.6
CVE-2026-22248	8.8	0%	Mar 11	GLPI affected by Remote Code Execution via malicious upload Affected: >= 11.0.0, < 11.0.5
CVE-2026-22044	8.8	0%	Feb 4	GLPI is Vulnerable to Authenticated SQL Injection Affected: >= 0.85, < 10.0.23
CVE-2025-24801	8.8	21%	Mar 18	GLPI is a free asset and IT management software package Affected: 0.85 before 10.0.18
CVE-2024-47760	8.8	0%	Dec 11	GLPI is a free asset and IT management software package Affected: 9.1.0 before 10.0.17
CVE-2024-47758	8.8	0%	Dec 11	GLPI is a free asset and IT management software package Affected: 9.3.0 before 10.0.17
CVE-2024-45608	8.8	1%	Nov 15	GLPI is a free asset and IT management software package Affected: 9.5.0 before 10.0.17
CVE-2024-41679	8.8	1%	Nov 15	GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.17
CVE-2024-40638	8.8	38%	Nov 15	GLPI is a free asset and IT management software package Affected: 0.85 before 10.0.17
CVE-2024-37149	8.8	21%	Jul 10	GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 0.85 before 10.0.16
CVE-2024-27756	8.8	1%	Mar 15	GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title Affected: through 10.0.12
CVE-2023-43813	8.8	31%	Dec 13	GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.11
CVE-2023-41326	8.8	37%	Sep 27	GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 9.5.0 before 10.0.10
CVE-2023-41324	8.8	1%	Sep 27	GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 9.3.0 before 10.0.10
CVE-2023-41322	8.8	1%	Sep 27	GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 9.1.0 before 10.0.10
CVE-2023-28634	8.8	1%	Apr 5	GLPI is a free asset and IT management software package Affected: 0.83 before 9.5.13; 10.0.0 before 10.0.7
CVE-2022-39234	8.8	0%	Nov 3	user session persists even after permanently deleting account in GLPI Affected: < 10.0.4
CVE-2021-39213	8.8	1%	Sep 15	GLPI is a free Asset and IT management software package Affected: 9.1 before 9.5.6
CVE-2021-39209	8.8	1%	Sep 15	GLPI is a free Asset and IT management software package Affected: before 9.5.6
CVE-2020-11060	8.8	11%	May 12	In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality Affected: before 9.4.6
CVE-2019-14666	8.8	2%	Sep 25	GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature Affected: through 9.4.3
CVE-2018-13049	8.8	1%	Jul 2	The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php Affected: 9.2.0 through 9.3.0