GL
Product
glpi
On CISA KEVExploited in the wild
214
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 27High 64Medium 108Low 3
Watch
Add glpi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-53112 | 4.3 | Jul 30 | GLPI's incomprehensive permission checks can lead to data removal from allowed users Affected: >= 9.1.0, < 10.0.19 |
| CVE-2025-23024 | 4.3 | Feb 25 | GLPI is a free asset and IT management software package Affected: 0.72 before 10.0.18 |
| CVE-2024-37147 | 4.3 | Jul 10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 0.85 before 10.0.16 |
| CVE-2024-27937 | 4.3 | Mar 18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 10.0.0 before 10.0.13 |
| CVE-2022-39370 | 4.3 | Nov 3 | Improper access to debug panel in GLPI Affected: >= 0.70, < 10.0.4 |
| CVE-2020-27663 | 4.3 | Nov 26 | In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket,… Affected: before 9.5.3 |
| CVE-2020-27662 | 4.3 | Nov 26 | In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g.,… Affected: before 9.5.3 |
| CVE-2020-15226 | 4.3 | Oct 7 | In GLPI before version 9.5.2, there is a SQL Injection in the API's search function Affected: before 9.5.2 |