GL
Product
glpi
On CISA KEVExploited in the wild
214
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 27High 64Medium 108Low 3
Watch
Add glpi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-11475 | 8.8 | Jul 20 | GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php Affected: through 9.1.5.0 |
| CVE-2020-15176 | 8.6 | Oct 7 | In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur Affected: before 9.5.2 |
| CVE-2026-47679 | 8.5 | Sep 25 | GLPI: arbitrary file deletion Affected: >= 10.0.0, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2026-55214 | 8.5 | Sep 25 | GLPI: Stored XSS in suppliers Affected: >= 11.0.6, < 11.0.8 |
| CVE-2026-42321 | 8.4 | Jun 3 | GLPI has stored XSS in asset locks Affected: >= 10.0.4, < 10.0.25 |
| CVE-2026-5385 | 8.4 | Jun 2 | GLPI 11.0.0 - Stored XSS in knowledge base Affected: before 11.0.7 |
| CVE-2024-48912 | 8.1 | Dec 11 | GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.17 |
| CVE-2024-37148 | 8.1 | Jul 10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 0.84 before 10.0.16 |
| CVE-2024-29889 | 8.1 | May 7 | GLPI is a Free Asset and IT Management Software package Affected: 10.0.10 before 10.0.15 |
| CVE-2023-51446 | 8.1 | Feb 1 | GLPI is a Free Asset and IT Management Software package Affected: 0.70 before 10.0.12 |
| CVE-2023-35939 | 8.1 | Jul 5 | GLPI is a free asset and IT management software package Affected: 9.5.0 before 10.0.8 |
| CVE-2023-28838 | 8.1 | Apr 5 | GLPI is a free asset and IT management software package Affected: 0.50 before 9.5.13; 10.0.0 before 10.0.7 |
| CVE-2023-28632 | 8.1 | Apr 5 | GLPI is a free asset and IT management software package Affected: 0.83 before 9.5.13; 10.0.0 before 10.0.7 |
| CVE-2019-10233 | 8.1 | Mar 27 | Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie Affected: before 9.4.1.1 |
| CVE-2016-7507 | 8.0 | Jul 19 | Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the… Affected: 0.90.4 |
| CVE-2026-49470 | 7.7 | Sep 25 | GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force Affected: >= 11.0.0, < 11.0.8 |
| CVE-2026-53625 | 7.5 | Sep 25 | GLPI: Privilege Escalation via authtype API manipulation Affected: >= 0.70, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2026-53610 | 7.5 | Sep 25 | GLPI: Reflected XSS in dashboards Affected: >= 11.0.0, < 11.0.8 |
| CVE-2025-64516 | 7.5 | Jan 15 | GLPI incorrectly authorizes access to documents Affected: >= 10.0.0, < 10.0.21; >= 11.0.0, < 11.0.3 |
| CVE-2025-53105 | 7.5 | Aug 27 | GLPI permits unauthorized rules execution order Affected: >= 10.0.0, < 10.0.19 |
| CVE-2025-23046 | 7.5 | Feb 25 | GLPI is a free asset and IT management software package Affected: 9.5.0 before 10.0.18 |
| CVE-2024-38370 | 7.5 | Nov 15 | GLPI is a free asset and IT management software package Affected: 9.2.0 before 10.0.16 |
| CVE-2023-35940 | 7.5 | Jul 5 | GLPI is a free asset and IT management software package Affected: 9.5.0 before 10.0.8 |
| CVE-2023-22500 | 7.5 | Jan 26 | GLPI is a Free Asset and IT Management Software package Affected: 10.0.0 before 10.0.6 |
| CVE-2022-24867 | 7.5 | Apr 21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing Affected: before 10.0.0 |
| CVE-2021-21327 | 7.5 | Mar 8 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: before 9.5.4 |
| CVE-2020-11031 | 7.5 | Sep 23 | In GLPI before version 9.5.0, the encryption algorithm used is insecure Affected: before 9.5.0 |
| CVE-2013-2227 | 7.5 | Nov 1 | GLPI 0.83.7 has Local File Inclusion in common.tabs.php Affected: 0.83.7 |
| CVE-2018-7562 | 7.5 | Mar 12 | A remote code execution issue was discovered in GLPI through 9.2.1 Affected: through 9.2.1 |
| CVE-2016-7508 | 7.5 | Jun 21 | Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character when the database is… Affected: 0.90.4 |
| CVE-2026-26026 | 7.2 | Apr 6 | GLPI has a Server-Side Template Injection via Double-Compilation Affected: >= 11.0.0, < 11.0.6 |
| CVE-2024-47761 | 7.2 | Dec 11 | GLPI is a free asset and IT management software package Affected: 0.80 before 10.0.17 |
| CVE-2020-11033 | 7.2 | May 5 | In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User Affected: 9.1 before 9.4.6 |
| CVE-2020-11032 | 7.2 | May 5 | In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances Affected: 9.4.5 |
| CVE-2026-53629 | 7.1 | Sep 25 | GLPI: SQL injection in history tab Affected: >= 9.4.0, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2026-53626 | 7.1 | Sep 25 | GLPI: Arbitrary Document Read via Form Context Authorization Bypass Affected: >= 11.0.5, < 11.0.8 |
| CVE-2026-40108 | 7.1 | Jun 2 | GLPI Vulnerable to Stored XSS in ITIL Costs Affected: >= 11.0.0, < 11.0.7 |
| CVE-2020-15108 | 7.1 | Jul 17 | In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature Affected: before 9.5.1 |
| CVE-2026-42318 | 7.0 | Jun 3 | GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint Affected: >= 11.0.0, < 11.0.7; >= 9.5.0, < 10.0.25 |
| CVE-2026-42317 | 7.0 | Jun 3 | GLPI vulnerable to arbitrary files deletion by technician Affected: >= 11.0.0, < 11.0.7; >= 0.78, < 10.0.25 |
| CVE-2026-44281 | 7.0 | Jun 3 | GLPI vulnerable to unauthorized reading of a specific asset object Affected: >= 11.0.0, < 11.0.7; >= 0.78, < 10.0.25 |
| CVE-2026-25937 | 6.5 | Mar 17 | GLPI has a MFA bypass Affected: >= 11.0.0, < 11.0.6 |
| CVE-2026-23624 | 6.5 | Feb 4 | GLPI is vulnerable to session stealing on externally authenticated user change Affected: >= 0.71, < 10.0.23; >= 11.0.0-alpha, < 11.0.5 |
| CVE-2025-59935 | 6.5 | Dec 16 | GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page Affected: >= 10.0.0, < 10.0.21 |
| CVE-2025-53111 | 6.5 | Jul 30 | GLPI exposes data to non-allowed users Affected: >= 0.80, < 10.0.19 |
| CVE-2025-53008 | 6.5 | Jul 30 | GLPI's MailCollector Receiver is vulnerable to credential exfiltration Affected: >= 9.3.1, < 10.0.19 |
| CVE-2025-25192 | 6.5 | Feb 25 | GLPI is a free asset and IT management software package Affected: before 10.0.18 |
| CVE-2025-21626 | 6.5 | Feb 25 | GLPI is a free asset and IT management software package Affected: 0.71 before 10.0.18 |
| CVE-2024-31456 | 6.5 | May 7 | GLPI is a Free Asset and IT Management Software package Affected: 9.3.0 before 10.0.15 |
| CVE-2024-27096 | 6.5 | Mar 18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 0.65 before 10.0.13 |