GL
Product
glpi
On CISA KEVExploited in the wild
214
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 27High 64Medium 108Low 3
Watch
Add glpi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-2227 | 7.5 | Nov 1 | GLPI 0.83.7 has Local File Inclusion in common.tabs.php Affected: 0.83.7 |
| CVE-2018-7562 | 7.5 | Mar 12 | A remote code execution issue was discovered in GLPI through 9.2.1 Affected: through 9.2.1 |
| CVE-2016-7508 | 7.5 | Jun 21 | Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character when the database is… Affected: 0.90.4 |
| CVE-2026-26026 | 7.2 | Apr 6 | GLPI has a Server-Side Template Injection via Double-Compilation Affected: >= 11.0.0, < 11.0.6 |
| CVE-2024-47761 | 7.2 | Dec 11 | GLPI is a free asset and IT management software package Affected: 0.80 before 10.0.17 |
| CVE-2020-11033 | 7.2 | May 5 | In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User Affected: 9.1 before 9.4.6 |
| CVE-2020-11032 | 7.2 | May 5 | In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances Affected: 9.4.5 |
| CVE-2026-53629 | 7.1 | Sep 25 | GLPI: SQL injection in history tab Affected: >= 9.4.0, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2026-53626 | 7.1 | Sep 25 | GLPI: Arbitrary Document Read via Form Context Authorization Bypass Affected: >= 11.0.5, < 11.0.8 |
| CVE-2026-40108 | 7.1 | Jun 2 | GLPI Vulnerable to Stored XSS in ITIL Costs Affected: >= 11.0.0, < 11.0.7 |
| CVE-2020-15108 | 7.1 | Jul 17 | In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature Affected: before 9.5.1 |
| CVE-2026-42318 | 7.0 | Jun 3 | GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint Affected: >= 11.0.0, < 11.0.7; >= 9.5.0, < 10.0.25 |
| CVE-2026-42317 | 7.0 | Jun 3 | GLPI vulnerable to arbitrary files deletion by technician Affected: >= 11.0.0, < 11.0.7; >= 0.78, < 10.0.25 |
| CVE-2026-44281 | 7.0 | Jun 3 | GLPI vulnerable to unauthorized reading of a specific asset object Affected: >= 11.0.0, < 11.0.7; >= 0.78, < 10.0.25 |