GL
Product
glpi
On CISA KEVExploited in the wild
214
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 27High 64Medium 108Low 3
Watch
Add glpi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-35914 In wildKEV | 9.8 | Sep 19 | Teclib GLPI Remote Code Execution Vulnerability Affected: through 10.0.2 |
| CVE-2026-26263 | 9.8 | Apr 6 | GLPI has an Unauthenticated SQL Injection via Search engine Affected: >= 11.0.0, < 11.0.6 |
| CVE-2025-66417 | 9.8 | Jan 15 | GLPI has an unauthenticated SQL injection through the inventory endpoint Affected: >= 11.0.0, < 11.0.3 |
| CVE-2025-24799 | 9.8 | Mar 18 | GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.18 |
| CVE-2025-21619 | 9.8 | Mar 18 | GLPI is a free asset and IT management software package Affected: 0.78 before 10.0.18 |
| CVE-2023-46727 | 9.8 | Dec 13 | GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.11 |
| CVE-2023-46726 | 9.8 | Dec 13 | GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.11 |
| CVE-2023-42802 | 9.8 | Nov 2 | GLPI is a free asset and IT management software package Affected: 10.0.7 before 10.0.10 |
| CVE-2023-42461 | 9.8 | Sep 27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 10.0.0 before 10.0.10 |
| CVE-2023-41320 | 9.8 | Sep 27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 10.0.0 before 10.0.10 |
| CVE-2023-36808 | 9.8 | Jul 5 | GLPI is a free asset and IT management software package Affected: 0.80 before 10.0.8 |
| CVE-2023-35924 | 9.8 | Jul 5 | GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.8 |
| CVE-2022-39323 | 9.8 | Nov 3 | SQL Injection on REST API in GLPI Affected: < 10.0.4 |
| CVE-2022-35947 | 9.8 | Sep 14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 10.0.3 |
| CVE-2022-31061 | 9.8 | Jun 28 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 9.3.0 before 9.5.8; 10.0.0 before 10.0.2 |
| CVE-2022-31056 | 9.8 | Jun 28 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 10.0.0 before 10.0.2 |
| CVE-2021-44617 | 9.8 | Mar 28 | A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated Affected: 9.4.6 |
| CVE-2017-11184 | 9.8 | Jul 28 | SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter Affected: through 9.1.4 |
| CVE-2017-11474 | 9.8 | Jul 20 | GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php Affected: through 9.1.5.0 |
| CVE-2017-11329 | 9.8 | Jul 17 | GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers Affected: through 9.1.4 |
| CVE-2024-27098 | 9.6 | Mar 18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 9.5.0 before 10.0.13 |
| CVE-2026-48482 | 9.4 | Sep 25 | GLPI: RCE via Form import Affected: >= 11.0.0, < 11.0.8 |
| CVE-2020-11035 | 9.3 | May 5 | In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm Affected: 0.83.3 before 9.4.6 |
| CVE-2026-22247 | 9.1 | Feb 4 | GLPI is Vulnerable to SSRF via Webhooks Affected: >= 11.0.0, < 11.0.5 |
| CVE-2023-42462 | 9.1 | Sep 27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 10.0.0 before 10.0.10 |
| CVE-2023-37278 | 9.1 | Jul 13 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: before 10.0.9 |
| CVE-2020-15175 | 9.1 | Oct 7 | In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin Affected: before 9.5.2 |
Showing 27