GL
Product
glpi
On CISA KEVExploited in the wild
214
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 27High 64Medium 108Low 3
Watch
Add glpi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-27514 | 5.4 | Jul 29 | GLPI is susceptible to Stored XSS attack through project's kanban Affected: >= 9.5.0, < 10.0.19 |
| CVE-2024-45611 | 5.4 | Nov 15 | GLPI has a stored XSS at src/RSSFeed.php Affected: >= 0.84, < 10.0.17 |
| CVE-2023-41888 | 5.4 | Sep 27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 10.0.8 before 10.0.10 |
| CVE-2023-28849 | 5.4 | Apr 5 | GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.7 |
| CVE-2023-28633 | 5.4 | Apr 5 | GLPI is a free asset and IT management software package Affected: 0.84 before 9.5.13; 10.0.0 before 10.0.7 |
| CVE-2022-39371 | 5.4 | Nov 3 | Stored Cross-Site Scripting (XSS) through asset inventory in GLPI Affected: >= 10.0.0, < 10.0.4 |
| CVE-2022-39375 | 5.4 | Nov 3 | Cross-Site Scripting (XSS) through public RSS feed in GLPI Affected: >= 0.84, < 10.0.4 |
| CVE-2022-39372 | 5.4 | Nov 3 | Stored Cross-Site Scripting (XSS) in user information in GLPI Affected: >= 0.70, < 10.0.4 |
| CVE-2022-31187 | 5.4 | Sep 14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 10.0.3 |
| CVE-2022-24876 | 5.4 | Jun 9 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0 |
| CVE-2022-24869 | 5.4 | Apr 21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing Affected: through 0.90 |
| CVE-2022-24868 | 5.4 | Apr 21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing Affected: before 10.0.0 |
| CVE-2021-21258 | 5.4 | Mar 2 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 9.5.0 before 9.5.4 |
| CVE-2020-11062 | 5.4 | May 12 | In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type Affected: 0.68.1 before 9.4.6 |
| CVE-2020-11036 | 5.4 | May 5 | In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities Affected: before 9.4.6 |
| CVE-2019-1010307 | 5.4 | Jul 15 | GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS) Affected: 9.3.1 |
| CVE-2016-7509 | 5.4 | Jul 19 | Cross-site scripting (XSS) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket Affected: 0.90.4 |
| CVE-2026-55217 | 5.3 | Sep 25 | GLPI: Unallowed modfication of knowbase items comments and translations Affected: >= 0.85, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2026-45801 | 5.3 | Sep 25 | GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) Affected: >= 0.72, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2023-53943 | 5.3 | Dec 18 | GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint Affected: 9.5.7 |
| CVE-2024-50339 | 5.3 | Dec 11 | GLPI vulnerable to unauthenticated session hijacking Affected: >= 9.5.0, < 10.0.17 |
| CVE-2024-43416 | 5.3 | Nov 18 | GLPI vulnerable to enumeration of users' email addresses by unauthenticated user Affected: >= 0.80, < 10.0.17 |
| CVE-2023-41323 | 5.3 | Sep 27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 0.68 before 10.0.10 |
| CVE-2022-39276 | 5.3 | Nov 3 | Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning Affected: < 10.0.4 |
| CVE-2022-31143 | 5.3 | Sep 14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 10.0.3 |
| CVE-2022-31068 | 5.3 | Jun 28 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 10.0.0 before 10.0.2 |
| CVE-2021-39211 | 5.3 | Sep 15 | GLPI is a free Asset and IT management software package Affected: 9.2 before 9.5.6 |
| CVE-2020-15217 | 5.3 | Oct 7 | In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ Affected: 9.5.0 before 9.5.2 |
| CVE-2020-5248 | 5.3 | May 12 | GLPI before before version 9.4.6 has a vulnerability involving a default encryption key Affected: before 9.4.6 |
| CVE-2025-52567 | 5.0 | Jul 30 | GLPI has overly permissive URL verification Affected: >= 0.84, < 10.0.19 |
| CVE-2022-21720 | 4.9 | Jan 28 | GLPI is a free asset and IT management software package Affected: before 9.5.7 |
| CVE-2017-11183 | 4.9 | Jul 28 | front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter Affected: through 9.1.4 |
| CVE-2026-25932 | 4.8 | Apr 6 | GLPI has Stored XSS in Supplier 'Website' field Affected: >= 0.60, < 10.0.24 |
| CVE-2024-47759 | 4.8 | Nov 15 | GLPI has a stored XSS via document upload Affected: >= 9.2.0, < 10.0.17 |
| CVE-2024-27104 | 4.8 | Mar 18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 9.5.0 before 10.0.13 |
| CVE-2023-28852 | 4.8 | Apr 5 | GLPI is a free asset and IT management software package Affected: 9.5.0 before 9.5.13; 10.0.0 before 10.0.7 |
| CVE-2023-28636 | 4.8 | Apr 5 | GLPI is a free asset and IT management software package Affected: 0.60 before 9.5.13; 10.0.0 before 10.0.7 |
| CVE-2023-22725 | 4.8 | Jan 26 | GLPI is a Free Asset and IT Management Software package Affected: 0.60 before 9.5.12; 10.0.0 before 10.0.6 |
| CVE-2023-22724 | 4.8 | Jan 26 | GLPI is a Free Asset and IT Management Software package Affected: 10.0.0 before 10.0.6 |
| CVE-2022-41941 | 4.8 | Jan 26 | GLPI is a Free Asset and IT Management Software package Affected: 0.70 before 9.5.12; 10.0.0 before 10.0.6 |
| CVE-2022-39277 | 4.8 | Nov 3 | Cross-Site Scripting (XSS) in external links in GLPI Affected: >= 0.60, < 10.0.4 |
| CVE-2022-39262 | 4.8 | Nov 3 | Stored Cross-Site Scripting (XSS) on login page in GLPI Affected: < 10.0.4 |
| CVE-2022-39373 | 4.8 | Nov 3 | Stored Cross-Site Scripting (XSS) in entity name in GLPI Affected: >= 10.0.0, < 10.0.4 |
| CVE-2021-21325 | 4.8 | Mar 8 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: before 9.5.4 |
| CVE-2021-21314 | 4.8 | Mar 3 | GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package Affected: before 9.5.4 |
| CVE-2021-21312 | 4.8 | Mar 3 | GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package Affected: before 9.5.4 |
| CVE-2026-49469 | 4.6 | Sep 25 | GLPI: LDAP filter injection in user import feature Affected: >= 0.70, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2026-108726 | 4.3 | Oct 11 | GLPI through 12.0.0 Missing Authorization via ajax/map.php Affected: through 12.0.0 |
| CVE-2026-32312 | 4.3 | May 18 | GLPI: Unauthorized export of form structure Affected: >= 11.0.0, < 11.0.7 |
| CVE-2025-64520 | 4.3 | Dec 16 | GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API Affected: >= 9.1.0, < 10.0.21 |