GL
Product
glpi
On CISA KEVExploited in the wild
214
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 27High 64Medium 108Low 3
Watch
Add glpi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25937 | 6.5 | Mar 17 | GLPI has a MFA bypass Affected: >= 11.0.0, < 11.0.6 |
| CVE-2026-23624 | 6.5 | Feb 4 | GLPI is vulnerable to session stealing on externally authenticated user change Affected: >= 0.71, < 10.0.23; >= 11.0.0-alpha, < 11.0.5 |
| CVE-2025-59935 | 6.5 | Dec 16 | GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page Affected: >= 10.0.0, < 10.0.21 |
| CVE-2025-53111 | 6.5 | Jul 30 | GLPI exposes data to non-allowed users Affected: >= 0.80, < 10.0.19 |
| CVE-2025-53008 | 6.5 | Jul 30 | GLPI's MailCollector Receiver is vulnerable to credential exfiltration Affected: >= 9.3.1, < 10.0.19 |
| CVE-2025-25192 | 6.5 | Feb 25 | GLPI is a free asset and IT management software package Affected: before 10.0.18 |
| CVE-2025-21626 | 6.5 | Feb 25 | GLPI is a free asset and IT management software package Affected: 0.71 before 10.0.18 |
| CVE-2024-31456 | 6.5 | May 7 | GLPI is a Free Asset and IT Management Software package Affected: 9.3.0 before 10.0.15 |
| CVE-2024-27096 | 6.5 | Mar 18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 0.65 before 10.0.13 |
| CVE-2024-27930 | 6.5 | Mar 18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 0.78 before 10.0.13 |
| CVE-2023-41321 | 6.5 | Sep 27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: 9.1.1 before 10.0.10 |
| CVE-2023-34107 | 6.5 | Jul 5 | GLPI is a free asset and IT management software package Affected: 9.2.0 before 10.0.8 |
| CVE-2023-34106 | 6.5 | Jul 5 | GLPI is a free asset and IT management software package Affected: 0.68 before 10.0.8 |
| CVE-2023-23610 | 6.5 | Jan 26 | GLPI is a Free Asset and IT Management Software package Affected: 0.65 before 9.5.12; 10.0.0 before 10.0.6 |
| CVE-2022-39376 | 6.5 | Nov 3 | Improper input validation on emails links in GLPI Affected: >= 0.65, < 10.0.4 |
| CVE-2022-35946 | 6.5 | Sep 14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 10.0.3 |
| CVE-2022-29250 | 6.5 | Jun 9 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0 |
| CVE-2021-39210 | 6.5 | Sep 15 | GLPI is a free Asset and IT management software package Affected: before 9.5.6 |
| CVE-2021-21326 | 6.5 | Mar 8 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: before 9.5.4 |
| CVE-2021-21324 | 6.5 | Mar 8 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: before 9.5.4 |
| CVE-2020-26212 | 6.5 | Nov 25 | GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 9.5.3 |
| CVE-2026-26027 | 6.1 | Apr 6 | GLPI has an Unauthenticated Stored XSS via inventory Affected: >= 11.0.0, < 11.0.6 |
| CVE-2025-52897 | 6.1 | Jul 30 | GLPI is vulnerable to XSS and open redirection attacks through planning feature Affected: >= 9.1.0, < 10.0.19 |
| CVE-2025-21627 | 6.1 | Feb 25 | GLPI is a free asset and IT management software package Affected: before 10.0.18 |
| CVE-2024-11955 | 6.1 | Feb 25 | A vulnerability was found in GLPI up to 10.0.17 Affected: 0.85 before 10.0.18 |
| CVE-2024-45610 | 6.1 | Nov 15 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 10.0.0 before 10.0.17 |
| CVE-2024-45609 | 6.1 | Nov 15 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 0.70 before 10.0.17 |
| CVE-2024-43418 | 6.1 | Nov 15 | GLPI is a free asset and IT management software package Affected: 0.65 before 10.0.17 |
| CVE-2024-43417 | 6.1 | Nov 15 | GLPI is a free asset and IT management software package Affected: 10.0.0 before 10.0.17 |
| CVE-2024-41678 | 6.1 | Nov 15 | GLPI is a free asset and IT management software package Affected: 0.50 before 10.0.17 |
| CVE-2024-27914 | 6.1 | Mar 18 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing Affected: 10.0.8 before 10.0.13 |
| CVE-2024-23645 | 6.1 | Feb 1 | GLPI is a Free Asset and IT Management Software package Affected: 0.65 before 10.0.12 |
| CVE-2023-34244 | 6.1 | Jul 5 | GLPI is a free asset and IT management software package Affected: 9.4.0 before 10.0.8 |
| CVE-2023-28639 | 6.1 | Apr 5 | GLPI is a free asset and IT management software package Affected: 0.85 before 9.5.13; 10.0.0 before 10.0.7 |
| CVE-2023-22722 | 6.1 | Jan 26 | GLPI is a Free Asset and IT Management Software package Affected: 9.4.0 before 9.5.12; 10.0.0 before 10.0.6 |
| CVE-2022-35945 | 6.1 | Sep 14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 10.0.3 |
| CVE-2022-21719 | 6.1 | Jan 28 | GLPI is a free asset and IT management software package Affected: before 9.5.7 |
| CVE-2021-3486 | 6.1 | May 26 | GLPi 9.5.4 does not sanitize the metadata Affected: 9.5.4 |
| CVE-2021-21313 | 6.1 | Mar 3 | GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package Affected: before 9.5.4 |
| CVE-2020-15177 | 6.1 | Oct 7 | In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api` Affected: before 9.5.2 |
| CVE-2020-11034 | 6.1 | May 5 | In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp Affected: before 9.4.6 |
| CVE-2019-13239 | 6.1 | Jul 4 | inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture Affected: 9.1 before 9.4.3 |
| CVE-2018-7563 | 6.1 | Mar 12 | An issue was discovered in GLPI through 9.2.1 Affected: through 9.2.1 |
| CVE-2026-53627 | 6.0 | Sep 25 | GLPI: Unexpected access to update operations through the API Affected: >= 11.0.0, < 11.0.8 |
| CVE-2026-53628 | 5.9 | Sep 25 | GLPI: Unallowed authentication method update by administrator Affected: >= 0.84, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2026-42320 | 5.9 | Jun 3 | GLPI vulnerable to arbitrary file access Affected: >= 11.0.0, < 11.0.7; >= 0.50, < 10.0.25 |
| CVE-2019-13240 | 5.9 | Jul 10 | An issue was discovered in GLPI before 9.4.1 Affected: before 9.4.1 |
| CVE-2022-36112 | 5.8 | Sep 14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 10.0.3 |
| CVE-2021-21255 | 5.7 | Mar 2 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 9.5.3 |
| CVE-2025-53357 | 5.4 | Jul 30 | GLPI permits reservation modification by unauthorized users Affected: >= 0.78, < 10.0.19 |