GL
Product
glpi
On CISA KEVExploited in the wild
213
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 27High 63Medium 108Low 3
Watch
Add glpi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-29047 | 8.8 | Apr 6 | GLPI has an Authenticated SQL Injection via log exports Affected: >= 10.0.0, 10.0.24; >= 11.0.0-alpha, < 11.0.6 |
| CVE-2026-25936 | 8.8 | Mar 17 | GLPI Vulnerable to Authenticated SQL Injection Affected: >= 11.0.0, < 11.0.6 |
| CVE-2026-22248 | 8.8 | Mar 11 | GLPI affected by Remote Code Execution via malicious upload Affected: >= 11.0.0, < 11.0.5 |
| CVE-2026-22044 | 8.8 | Feb 4 | GLPI is Vulnerable to Authenticated SQL Injection Affected: >= 0.85, < 10.0.23 |
| CVE-2025-24801 | 8.8 | Mar 18 | GLPI is a free asset and IT management software package Affected: 0.85 before 10.0.18 |
| CVE-2024-47760 | 8.8 | Dec 11 | GLPI is a free asset and IT management software package Affected: 9.1.0 before 10.0.17 |
| CVE-2024-47758 | 8.8 | Dec 11 | GLPI is a free asset and IT management software package Affected: 9.3.0 before 10.0.17 |
| CVE-2024-45608 | 8.8 | Nov 15 | GLPI is a free asset and IT management software package Affected: 9.5.0 before 10.0.17 |
| CVE-2024-41679 | 8.8 | Nov 15 | GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.17 |
| CVE-2024-40638 | 8.8 | Nov 15 | GLPI is a free asset and IT management software package Affected: 0.85 before 10.0.17 |
| CVE-2024-37149 | 8.8 | Jul 10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 0.85 before 10.0.16 |
| CVE-2024-27756 | 8.8 | Mar 15 | GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title Affected: through 10.0.12 |
| CVE-2023-43813 | 8.8 | Dec 13 | GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.11 |
| CVE-2023-41326 | 8.8 | Sep 27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 9.5.0 before 10.0.10 |
| CVE-2023-41324 | 8.8 | Sep 27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 9.3.0 before 10.0.10 |
| CVE-2023-41322 | 8.8 | Sep 27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 9.1.0 before 10.0.10 |
| CVE-2023-28634 | 8.8 | Apr 5 | GLPI is a free asset and IT management software package Affected: 0.83 before 9.5.13; 10.0.0 before 10.0.7 |
| CVE-2022-39234 | 8.8 | Nov 3 | user session persists even after permanently deleting account in GLPI Affected: < 10.0.4 |
| CVE-2021-39213 | 8.8 | Sep 15 | GLPI is a free Asset and IT management software package Affected: 9.1 before 9.5.6 |
| CVE-2021-39209 | 8.8 | Sep 15 | GLPI is a free Asset and IT management software package Affected: before 9.5.6 |
| CVE-2020-11060 | 8.8 | May 12 | In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality Affected: before 9.4.6 |
| CVE-2019-14666 | 8.8 | Sep 25 | GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature Affected: through 9.4.3 |
| CVE-2018-13049 | 8.8 | Jul 2 | The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php Affected: 9.2.0 through 9.3.0 |
| CVE-2017-11475 | 8.8 | Jul 20 | GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php Affected: through 9.1.5.0 |
| CVE-2020-15176 | 8.6 | Oct 7 | In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur Affected: before 9.5.2 |
| CVE-2026-47679 | 8.5 | Sep 25 | GLPI: arbitrary file deletion Affected: >= 10.0.0, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2026-55214 | 8.5 | Sep 25 | GLPI: Stored XSS in suppliers Affected: >= 11.0.6, < 11.0.8 |
| CVE-2026-42321 | 8.4 | Jun 3 | GLPI has stored XSS in asset locks Affected: >= 10.0.4, < 10.0.25 |
| CVE-2026-5385 | 8.4 | Jun 2 | GLPI 11.0.0 - Stored XSS in knowledge base Affected: before 11.0.7 |
| CVE-2024-48912 | 8.1 | Dec 11 | GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.17 |
| CVE-2024-37148 | 8.1 | Jul 10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 0.84 before 10.0.16 |
| CVE-2024-29889 | 8.1 | May 7 | GLPI is a Free Asset and IT Management Software package Affected: 10.0.10 before 10.0.15 |
| CVE-2023-51446 | 8.1 | Feb 1 | GLPI is a Free Asset and IT Management Software package Affected: 0.70 before 10.0.12 |
| CVE-2023-35939 | 8.1 | Jul 5 | GLPI is a free asset and IT management software package Affected: 9.5.0 before 10.0.8 |
| CVE-2023-28838 | 8.1 | Apr 5 | GLPI is a free asset and IT management software package Affected: 0.50 before 9.5.13; 10.0.0 before 10.0.7 |
| CVE-2023-28632 | 8.1 | Apr 5 | GLPI is a free asset and IT management software package Affected: 0.83 before 9.5.13; 10.0.0 before 10.0.7 |
| CVE-2019-10233 | 8.1 | Mar 27 | Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie Affected: before 9.4.1.1 |
| CVE-2016-7507 | 8.0 | Jul 19 | Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the… Affected: 0.90.4 |
| CVE-2026-49470 | 7.7 | Sep 25 | GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force Affected: >= 11.0.0, < 11.0.8 |
| CVE-2026-53625 | 7.5 | Sep 25 | GLPI: Privilege Escalation via authtype API manipulation Affected: >= 0.70, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2026-53610 | 7.5 | Sep 25 | GLPI: Reflected XSS in dashboards Affected: >= 11.0.0, < 11.0.8 |
| CVE-2025-64516 | 7.5 | Jan 15 | GLPI incorrectly authorizes access to documents Affected: >= 10.0.0, < 10.0.21; >= 11.0.0, < 11.0.3 |
| CVE-2025-23046 | 7.5 | Feb 25 | GLPI is a free asset and IT management software package Affected: 9.5.0 before 10.0.18 |
| CVE-2024-38370 | 7.5 | Nov 15 | GLPI is a free asset and IT management software package Affected: 9.2.0 before 10.0.16 |
| CVE-2023-35940 | 7.5 | Jul 5 | GLPI is a free asset and IT management software package Affected: 9.5.0 before 10.0.8 |
| CVE-2023-22500 | 7.5 | Jan 26 | GLPI is a Free Asset and IT Management Software package Affected: 10.0.0 before 10.0.6 |
| CVE-2022-24867 | 7.5 | Apr 21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing Affected: before 10.0.0 |
| CVE-2021-21327 | 7.5 | Mar 8 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: before 9.5.4 |
| CVE-2020-11031 | 7.5 | Sep 23 | In GLPI before version 9.5.0, the encryption algorithm used is insecure Affected: before 9.5.0 |
| CVE-2013-2227 | 7.5 | Nov 1 | GLPI 0.83.7 has Local File Inclusion in common.tabs.php Affected: 0.83.7 |