Glpi
Monthly
SQL injection in GLPI's history/logs tab allows an authenticated attacker who holds the READ right on logs to inject attacker-controlled values into a database query via crafted affected_fields filter parameters in the history-tab URL. The flaw affects GLPI releases from 9.4.0 up to but not including 10.0.26 and 11.0.8, and exploitation is gated by the READ-on-logs privilege, which is not held by ordinary or self-service users by default. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has released fixes in 11.0.8 and 10.0.26, and the issue is well-confirmed by the vendor advisory and two upstream fix commits.
Authenticated users of GLPI 11.0.5 through 11.0.7 can read documents attached to items they are not authorized to access by supplying the itemtype and items_id of a different, legitimately viewable item as the linkage context in a document request. The flaw is an IDOR authorization bypass (CWE-639) in the document permission path, rated CVSS 4.0 7.1 (and CVSS 3.1 7.1 per independent assessment), with high confidentiality impact but no integrity or availability impact; valid credentials with permission to view at least one item are a prerequisite, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The issue is fixed in GLPI 11.0.8.
GLPI 11.0.0 through 11.0.7 allows an authenticated attacker holding the form-administration privilege to achieve remote code execution by importing a crafted form with an illustration or scene identifier containing path-traversal sequences, causing a file to be written outside the intended custom-asset directory and into a servable or executable location. The CVSS 4.0 base score is 9.4 (Critical), and exploitation requires an authenticated admin session (PR:H) with no user interaction. No public exploit code has been identified at time of analysis; the vendor has released version 11.0.8 to fix the issue.
Account takeover in GLPI is achievable by an authenticated technician-level user who supplies an 'authtype' value in a user-update call to the REST API, allowing them to silently change another account's authentication method - including that of a super-administrator. The issue affects GLPI from version 0.70 up to (but not including) 10.0.26 and 11.0.x before 11.0.8, and the dangerous takeover path is scoped to instances using the legacy REST API interface or SSO/external logins, since the attacker switches the victim onto an authentication method they control. Successful exploitation requires a valid authenticated account with rights to update other users but lacking the UPDATEAUTHENT right, plus the non-default legacy-API or SSO configuration; no public exploit code or confirmed active exploitation was identified at time of analysis, though the CVSS 4.0 base score is 7.5.
Reflected cross-site scripting in GLPI 11.0.0 through 11.0.7 lets an unauthenticated attacker craft a dashboard URL that reflects attacker-controlled markup into a dashboard widget's title attribute without sufficient output encoding; the payload only executes in the browser of an already-authenticated GLPI user who opens the crafted link (UI:R plus the CVSS-noted attack requirement AT:P). The vendor rates this CVSS 4.0 7.5, while the independent assessment scores it CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) because impact is confined to the victim's browser session. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the defect is fixed in GLPI 11.0.8.
Insufficient path validation in GLPI's profile-picture update flow lets any authenticated user - including ordinary self-service accounts with no administrative rights - force the application to delete an attacker-selected file on the server's filesystem. Affected releases are GLPI 10.0.0 through 10.0.25 and 11.0.x before 11.0.8; the flaw is fixed in 10.0.26 and 11.0.8. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 8.5 reflects a remote (AV:N), low-complexity (AC:L) attack with high integrity and availability impact once a valid low-privilege session (PR:L) is obtained.
Stored cross-site scripting in GLPI 11.0.6 through 11.0.8 allows an authenticated technician to inject active markup into supplier website fields, which executes in the browser of any user who opens the suppliers list for the affected contact or contract. The vulnerability is fixed in version 11.0.8, and no public exploit identified at time of analysis. Successful exploitation requires a privileged account (PR:H) and user interaction from a victim (UI:P), and the impact is limited to the victim's session context (CVSS 4.0 score 8.5).
Brute-force compromise of the second authentication factor in GLPI 11.0.0 through 11.0.7 lets an attacker who already holds a user's valid primary credentials repeatedly submit TOTP codes to the MFA verification endpoint, which applies no per-user limit on failed submissions, resulting in full account takeover. The weakness is a missing-anti-automation defect (CWE-307) that is reachable only after primary credential compromise and only on accounts where TOTP multi-factor authentication is actually enabled, so default deployments without MFA and instances patched to 11.0.8 are not affected. Exploitation is remote, requires authenticated (PR:L) access in the form of already-stolen credentials, and needs no user interaction, but no public exploit code has been identified and no active exploitation has been reported; the short validity window of a rotating time-based code is what pushes the official CVSS 4.0 score to 7.7 with high attack complexity rather than a critical rating.
Stored cross-site scripting in GLPI 10.0.4 through 10.0.24 allows an authenticated technician to persist a malicious JavaScript payload in the asset locked tab, which executes in the browser of any subsequent user who views the affected asset. The flaw carries a CVSS 4.0 score of 8.4 driven by high impact on confidentiality, integrity, and availability of the victim session, though exploitation requires high privileges (technician role) and user interaction. No public exploit identified at time of analysis and SSVC reports no observed exploitation.
Unauthorized object deletion in GLPI versions 9.5.0 through 10.0.24 and 11.0.0 through 11.0.6 allows authenticated low-privilege users with planning access to delete arbitrary objects across the asset and IT management platform. The flaw stems from a missing authorization check (CWE-862) tied to the planning module, and no public exploit identified at time of analysis. Patches are available in 10.0.25 and 11.0.7.
Arbitrary file deletion in GLPI versions 0.78 through 10.0.24 and 11.0.0 through 11.0.6 allows authenticated technicians to remove any file on the webserver filesystem to which the web process has write permissions. The flaw is tracked as a missing authorization issue (CWE-862) and is tagged as an authentication bypass; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authorization bypass in GLPI IT asset management software (versions 0.78 through 10.0.24 and 11.0.0 through 11.0.6) permits an authenticated user holding only the config READ permission to access a specific asset object that should be outside their authorization scope. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact. Vendor patches are available in 10.0.25 and 11.0.7.
Stored cross-site scripting in GLPI before 11.0.7 allows an attacker with write access to the knowledge base to embed a persistent XSS payload that executes in the browsers of users who later view the affected knowledge base item. The flaw was reported by Fluid Attacks and is rated High severity (CVSS 8.4) by the vendor, who shipped a fix in the 11.0.7 security release; no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
SQL injection in the logs export feature of GLPI lets an authenticated user with a low-privileged account inject arbitrary SQL through that export component, with assessed impact of high confidentiality and integrity loss (CVSS 8.8). Deployments running GLPI 10.0.0 through before 10.0.24, and the 11.0.0-alpha branch before 11.0.6, are affected; the vendor fixed the flaw in 10.0.24 and 11.0.6. Exploitation is not known to be active (no CISA KEV entry, SSVC exploitation: none) and no public exploit was identified at time of analysis, with EPSS at 0.03% (8th percentile) - realistic risk concentrates on insiders or attackers holding stolen credentials rather than unauthenticated outsiders.
Time-based blind SQL injection in GLPI's Search engine allows remote unauthenticated attackers to extract sensitive database contents and potentially achieve code execution. GLPI versions 11.0.0 through 11.0.5 are vulnerable. The CVSS vector (PR:N) confirms no authentication required, though attack complexity is rated high (AC:H). EPSS data not available, no CISA KEV listing indicates no confirmed active exploitation at time of analysis, but the unauthenticated remote attack surface and SQL injection nature present significant risk for this widely-deployed IT asset management platform.
Stored XSS in GLPI 11.0.0-11.0.5 allows remote attackers to inject malicious scripts via the inventory endpoint without authentication, leading to potential session hijacking and unauthorized actions when victims interact with poisoned inventory data. CVSS 7.5 (High) with Network attack vector and no privileges required (PR:N). No public exploit identified at time of analysis, though the unauthenticated nature and stored XSS persistence elevate practical risk for environments with publicly accessible GLPI installations.
Authenticated GLPI administrators can achieve remote code execution on GLPI 11.0.0 through 11.0.5 by injecting server-side template code, a flaw fixed in 11.0.6. The prerequisite is the highest-trust role in the application (CVSS PR:H, per the advisory the injection is performed 'by an administrator'), so real-world exposure is sharply constrained to already privileged or compromised admin accounts. No public exploit has been identified at time of analysis, EPSS is low at 0.04% (13th percentile), and CISA SSVC records no known exploitation and no automatable path.
licenses tracking and software auditing. From 11.0.0 to versions up to 11.0.5 is affected by deserialization of untrusted data (CVSS 8.0).
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.0%.
Authenticated low-privileged users can bypass authorization checks in GLPI through 12.0.0 via the ajax/map.php endpoint, disclosing match counts, titles, and coordinates of itemtypes such as Contact, Supplier, Contract, and Budget within their entities. This missing authorization (CWE-862) is a low-severity information-disclosure issue, as per our independent assessment; no public exploit has been identified at time of analysis, and the CVSS 3.1 vector indicates limited confidentiality impact (C:L) with no integrity or availability impact. Affected users must be authenticated with at least low privileges (PR:L) and network access to the endpoint.
Broken access control in GLPI's knowledge-base comment and translation handling lets any authenticated low-privilege user create, update, or delete comments and translations attached to knowledge base items they are not authorized to modify. The affected endpoints (front/knowbaseitem_comment.form.php and front/knowbaseitemtranslation.form.php) perform no per-item permission check, so a valid session with minimal rights is enough; no user interaction, elevated role, or unusual configuration is required, though an account is mandatory and the impact is limited to the integrity of KB comment/translation records (no disclosure, no code execution, no availability loss). The issue is fixed in GLPI 11.0.8 and 10.0.26; no public exploit code and no confirmed active exploitation were identified at time of analysis, and CVSS 5.3 reflects a low-to-moderate-priority flaw rather than a high-severity one.
Improper authorization in GLPI lets an authenticated administrator who holds the delegated 'Update auth and sync' or 'Update auth, sync and 2FA' right (User::UPDATEAUTHENT) change the authentication method and disable two-factor authentication for user accounts that lie outside that administrator's own entity scope. The weakness affects GLPI from 0.84 up to (but not including) 10.0.26, and the 11.x line from 11.0.0 up to but not including 11.0.8; it is only meaningful in multi-entity installations, since in single-entity deployments the administrator already legitimately controls every account. The impact is bounded to authentication-method changes and 2FA toggling rather than arbitrary account modification, vendor-released patches are available in 10.0.26 and 11.0.8, and no public exploit code has been identified at time of analysis.
Authenticated GLPI users who lack configuration-update privileges can enable the application's debug mode on versions 0.72 through 10.0.25 and 11.0.0 through 11.0.7 by injecting a use_mode parameter into the user-setting update endpoint, which pre-patch code failed to gate behind the Config::canUpdate() check. Successful abuse exposes debug-level diagnostic output that a legitimate low-privilege account should not be able to trigger, resulting in limited confidentiality impact; the flaw does not allow data modification or code execution. No public exploit code has been identified at time of analysis and there is no indication of active exploitation, though a vendor fix is available in GLPI 10.0.26 and 11.0.8. NVD rates the issue 5.3 (CVSS 4.0), and the independent assessment concurs that this is a low-to-moderate authorization weakness given the mandatory authentication prerequisite and confined information-exposure impact.
Missing authorization enforcement in GLPI's REST API v2 (the 'HL' API) lets a low-privileged authenticated user perform ticket team-member add/remove/list operations and entity transfers that the web interface would deny, because the API update flow does not re-apply per-object and per-right checks. Only GLPI 11.0.0 through 11.0.7 are affected - API v2 exists only in the 11.x line - and exploitation requires a valid, working low-privileged account using the API rather than the UI (authentication required, PR:L in both the vendor CVSS 4.0 vector and our assessed CVSS 3.1 vector). Impact is integrity-dominant (I:H) with limited confidentiality/availability effects; a vendor patch is available in 11.0.8 and no public exploit code or confirmed active exploitation was identified at time of analysis.
LDAP filter bypass in GLPI versions prior to 10.0.26 and 11.0.8 allows an authenticated hotliner or technician with access to the user-import feature to inject crafted criteria and read LDAP objects that the configured default filter was intended to exclude. The issue is a limited information-disclosure flaw: it does not grant write access, code execution, or access to GLPI's own data, and exploitation requires an existing LDAP integration with a configured default filter. No public exploit code was identified at time of analysis, and NVD rates it CVSS 4.6.
Authorization bypass in GLPI 11.0.5 through 11.0.7 exposes restricted documents to unauthorized network-based access via a manipulable docid parameter in the document download handler. The vulnerability resides in the Document::canViewFile authorization check within front/document.send.php, where an attacker can tamper with the docid argument to circumvent document-level access controls and retrieve files they are not permitted to view. No public exploit has been identified at time of analysis, and EPSS data was not provided; however, the remote network vector with no required privileges raises concern for exposed GLPI deployments.
Arbitrary file read within GLPI_DOC_DIR is exploitable by authenticated technicians in GLPI versions 0.50 through 10.0.24 and 11.0.0 through 11.0.6, stemming from missing authorization controls (CWE-862) on document directory access. An attacker holding a technician-level account can read any file stored under the GLPI_DOC_DIR path without appropriate privilege checks, exposing potentially sensitive documents, attachments, or internal data. No public exploit is identified at time of analysis, and CISA's SSVC framework rates exploitation as none with non-automatable attack paths.
Unauthorized form structure disclosure in GLPI 11.0.0 through 11.0.6 allows a high-privileged authenticated user holding forms READ permission to export the structural definition of forms they are not authorized to access. The flaw, rooted in CWE-862 (Missing Authorization), means the application validates that a user can perform form exports in general but fails to verify per-form access entitlements before returning structure data. Impact is limited to low confidentiality exposure of form schemas with no integrity or availability consequence. No public exploit code or CISA KEV listing exists at time of analysis, and the vendor has released a confirmed fix in 11.0.7.
Stored cross-site scripting (XSS) in GLPI asset management software allows authenticated technician-level users to inject malicious JavaScript into supplier fields, achieving code execution in victim browsers with high confidentiality, integrity, and availability impact. Affects GLPI versions 0.60 through 10.0.23, patched in version 10.0.24. EPSS data not available; no public exploit identified at time of analysis, and not listed in CISA KEV. The CVSS score of 7.2 reflects network-accessible attack requiring high privileges but no user interaction, making this a medium-priority issue for organizations running vulnerable GLPI instances with multiple technician accounts.
GLPI versions 11.0.0 through 11.0.5 contain an authentication bypass vulnerability that allows an attacker with knowledge of a user's credentials to circumvent multi-factor authentication (MFA) and gain unauthorized account access. This vulnerability affects the GLPI asset and IT management software and is classified as CWE-287 (Improper Authentication), with a CVSS score of 6.5 indicating medium severity. The issue has been patched in version 11.0.6, and while no active KEV listing or public proof-of-concept is noted in available sources, the authentication bypass nature suggests moderate exploitation probability.
GLPI versions 11.0.0 through 11.0.5 contain an authenticated SQL injection vulnerability that allows authenticated users to read sensitive database contents without modification or denial-of-service capabilities. The vulnerability affects the free Asset and IT management software package GLPI and is resolved in version 11.0.6. While the CVSS score of 6.5 reflects moderate severity, the impact is limited to confidentiality breach due to the read-only nature of the exploit and the requirement for prior authentication.
GLPI versions 0.71 through 10.0.22 and 11.0.4 are vulnerable to session hijacking when SSO-based remote authentication is enabled, allowing a local attacker to impersonate another user by stealing an active session on the same machine. An authenticated attacker with local access can exploit this by leveraging SSO variables to gain unauthorized access to victim sessions without requiring elevated privileges. No patch is currently available for this vulnerability.
GLPI versions 11.0.0 through 11.0.4 allow authenticated administrators to conduct Server-Side Request Forgery (SSRF) attacks via the Webhook functionality, potentially enabling reconnaissance of internal network resources. An attacker with administrative privileges could leverage this capability to probe internal services or bypass network access controls. A patch is available in version 11.0.5 and later.
Authenticated users in GLPI versions 0.85 through 10.0.22 can exploit a SQL injection vulnerability to read sensitive data from the application database. The vulnerability requires valid credentials and network access but does not allow data modification or denial of service. Version 10.0.23 contains the fix, though no patch is currently available for affected deployments.
GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. [CVSS 7.5 HIGH]
GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). [CVSS 7.5 HIGH]
GLPI versions 9.1.0 through 10.0.20 fail to apply knowledge base visibility restrictions on search and read operations, allowing an API caller to retrieve knowledge base entries that their user, group, profile, or entity permissions should not expose. Exploitation requires valid API access credentials (PR:L in the assessed vector), and the impact is limited to unauthorized read of knowledge base content with no write, modification, or denial-of-service effect. No public exploit code was identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS is very low at 0.22% (11th percentile), and a vendor patch is available in version 10.0.21.
Unauthenticated stored cross-site scripting in GLPI 10.0.0 through 10.0.20 lets a remote attacker push a persistent XSS payload into the inventory ingestion endpoint, which then executes in the browser of any authenticated user who later renders the poisoned inventory record in the web UI. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, and EPSS is low at 0.29% (20th percentile); however, the credential-free write path combined with execution inside a privileged user session makes this a moderate-priority issue whose practical concern exceeds its 6.5 base score. The vendor shipped a fix in GLPI 10.0.21.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. No vendor patch available.
GLPI IT asset management platform contains an unauthenticated SQL injection through the inventory endpoint. Attackers can extract the entire GLPI database including asset inventories, user credentials, helpdesk tickets, and IT infrastructure documentation without any authentication.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in GLPI up to 10.0.17. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GLPI is a free asset and IT management software package. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free Asset and IT management software package. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a Free Asset and IT Management Software package. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GLPI is a Free Asset and IT Management Software package. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GLPI is a Free Asset and IT Management Software package. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
GLPI is a free asset and IT management software package. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GLPI is a free asset and IT management software package. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GLPI is a free asset and IT management software package. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in GLPI's history/logs tab allows an authenticated attacker who holds the READ right on logs to inject attacker-controlled values into a database query via crafted affected_fields filter parameters in the history-tab URL. The flaw affects GLPI releases from 9.4.0 up to but not including 10.0.26 and 11.0.8, and exploitation is gated by the READ-on-logs privilege, which is not held by ordinary or self-service users by default. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has released fixes in 11.0.8 and 10.0.26, and the issue is well-confirmed by the vendor advisory and two upstream fix commits.
Authenticated users of GLPI 11.0.5 through 11.0.7 can read documents attached to items they are not authorized to access by supplying the itemtype and items_id of a different, legitimately viewable item as the linkage context in a document request. The flaw is an IDOR authorization bypass (CWE-639) in the document permission path, rated CVSS 4.0 7.1 (and CVSS 3.1 7.1 per independent assessment), with high confidentiality impact but no integrity or availability impact; valid credentials with permission to view at least one item are a prerequisite, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The issue is fixed in GLPI 11.0.8.
GLPI 11.0.0 through 11.0.7 allows an authenticated attacker holding the form-administration privilege to achieve remote code execution by importing a crafted form with an illustration or scene identifier containing path-traversal sequences, causing a file to be written outside the intended custom-asset directory and into a servable or executable location. The CVSS 4.0 base score is 9.4 (Critical), and exploitation requires an authenticated admin session (PR:H) with no user interaction. No public exploit code has been identified at time of analysis; the vendor has released version 11.0.8 to fix the issue.
Account takeover in GLPI is achievable by an authenticated technician-level user who supplies an 'authtype' value in a user-update call to the REST API, allowing them to silently change another account's authentication method - including that of a super-administrator. The issue affects GLPI from version 0.70 up to (but not including) 10.0.26 and 11.0.x before 11.0.8, and the dangerous takeover path is scoped to instances using the legacy REST API interface or SSO/external logins, since the attacker switches the victim onto an authentication method they control. Successful exploitation requires a valid authenticated account with rights to update other users but lacking the UPDATEAUTHENT right, plus the non-default legacy-API or SSO configuration; no public exploit code or confirmed active exploitation was identified at time of analysis, though the CVSS 4.0 base score is 7.5.
Reflected cross-site scripting in GLPI 11.0.0 through 11.0.7 lets an unauthenticated attacker craft a dashboard URL that reflects attacker-controlled markup into a dashboard widget's title attribute without sufficient output encoding; the payload only executes in the browser of an already-authenticated GLPI user who opens the crafted link (UI:R plus the CVSS-noted attack requirement AT:P). The vendor rates this CVSS 4.0 7.5, while the independent assessment scores it CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) because impact is confined to the victim's browser session. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the defect is fixed in GLPI 11.0.8.
Insufficient path validation in GLPI's profile-picture update flow lets any authenticated user - including ordinary self-service accounts with no administrative rights - force the application to delete an attacker-selected file on the server's filesystem. Affected releases are GLPI 10.0.0 through 10.0.25 and 11.0.x before 11.0.8; the flaw is fixed in 10.0.26 and 11.0.8. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 8.5 reflects a remote (AV:N), low-complexity (AC:L) attack with high integrity and availability impact once a valid low-privilege session (PR:L) is obtained.
Stored cross-site scripting in GLPI 11.0.6 through 11.0.8 allows an authenticated technician to inject active markup into supplier website fields, which executes in the browser of any user who opens the suppliers list for the affected contact or contract. The vulnerability is fixed in version 11.0.8, and no public exploit identified at time of analysis. Successful exploitation requires a privileged account (PR:H) and user interaction from a victim (UI:P), and the impact is limited to the victim's session context (CVSS 4.0 score 8.5).
Brute-force compromise of the second authentication factor in GLPI 11.0.0 through 11.0.7 lets an attacker who already holds a user's valid primary credentials repeatedly submit TOTP codes to the MFA verification endpoint, which applies no per-user limit on failed submissions, resulting in full account takeover. The weakness is a missing-anti-automation defect (CWE-307) that is reachable only after primary credential compromise and only on accounts where TOTP multi-factor authentication is actually enabled, so default deployments without MFA and instances patched to 11.0.8 are not affected. Exploitation is remote, requires authenticated (PR:L) access in the form of already-stolen credentials, and needs no user interaction, but no public exploit code has been identified and no active exploitation has been reported; the short validity window of a rotating time-based code is what pushes the official CVSS 4.0 score to 7.7 with high attack complexity rather than a critical rating.
Stored cross-site scripting in GLPI 10.0.4 through 10.0.24 allows an authenticated technician to persist a malicious JavaScript payload in the asset locked tab, which executes in the browser of any subsequent user who views the affected asset. The flaw carries a CVSS 4.0 score of 8.4 driven by high impact on confidentiality, integrity, and availability of the victim session, though exploitation requires high privileges (technician role) and user interaction. No public exploit identified at time of analysis and SSVC reports no observed exploitation.
Unauthorized object deletion in GLPI versions 9.5.0 through 10.0.24 and 11.0.0 through 11.0.6 allows authenticated low-privilege users with planning access to delete arbitrary objects across the asset and IT management platform. The flaw stems from a missing authorization check (CWE-862) tied to the planning module, and no public exploit identified at time of analysis. Patches are available in 10.0.25 and 11.0.7.
Arbitrary file deletion in GLPI versions 0.78 through 10.0.24 and 11.0.0 through 11.0.6 allows authenticated technicians to remove any file on the webserver filesystem to which the web process has write permissions. The flaw is tracked as a missing authorization issue (CWE-862) and is tagged as an authentication bypass; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authorization bypass in GLPI IT asset management software (versions 0.78 through 10.0.24 and 11.0.0 through 11.0.6) permits an authenticated user holding only the config READ permission to access a specific asset object that should be outside their authorization scope. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact. Vendor patches are available in 10.0.25 and 11.0.7.
Stored cross-site scripting in GLPI before 11.0.7 allows an attacker with write access to the knowledge base to embed a persistent XSS payload that executes in the browsers of users who later view the affected knowledge base item. The flaw was reported by Fluid Attacks and is rated High severity (CVSS 8.4) by the vendor, who shipped a fix in the 11.0.7 security release; no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
SQL injection in the logs export feature of GLPI lets an authenticated user with a low-privileged account inject arbitrary SQL through that export component, with assessed impact of high confidentiality and integrity loss (CVSS 8.8). Deployments running GLPI 10.0.0 through before 10.0.24, and the 11.0.0-alpha branch before 11.0.6, are affected; the vendor fixed the flaw in 10.0.24 and 11.0.6. Exploitation is not known to be active (no CISA KEV entry, SSVC exploitation: none) and no public exploit was identified at time of analysis, with EPSS at 0.03% (8th percentile) - realistic risk concentrates on insiders or attackers holding stolen credentials rather than unauthenticated outsiders.
Time-based blind SQL injection in GLPI's Search engine allows remote unauthenticated attackers to extract sensitive database contents and potentially achieve code execution. GLPI versions 11.0.0 through 11.0.5 are vulnerable. The CVSS vector (PR:N) confirms no authentication required, though attack complexity is rated high (AC:H). EPSS data not available, no CISA KEV listing indicates no confirmed active exploitation at time of analysis, but the unauthenticated remote attack surface and SQL injection nature present significant risk for this widely-deployed IT asset management platform.
Stored XSS in GLPI 11.0.0-11.0.5 allows remote attackers to inject malicious scripts via the inventory endpoint without authentication, leading to potential session hijacking and unauthorized actions when victims interact with poisoned inventory data. CVSS 7.5 (High) with Network attack vector and no privileges required (PR:N). No public exploit identified at time of analysis, though the unauthenticated nature and stored XSS persistence elevate practical risk for environments with publicly accessible GLPI installations.
Authenticated GLPI administrators can achieve remote code execution on GLPI 11.0.0 through 11.0.5 by injecting server-side template code, a flaw fixed in 11.0.6. The prerequisite is the highest-trust role in the application (CVSS PR:H, per the advisory the injection is performed 'by an administrator'), so real-world exposure is sharply constrained to already privileged or compromised admin accounts. No public exploit has been identified at time of analysis, EPSS is low at 0.04% (13th percentile), and CISA SSVC records no known exploitation and no automatable path.
licenses tracking and software auditing. From 11.0.0 to versions up to 11.0.5 is affected by deserialization of untrusted data (CVSS 8.0).
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.0%.
Authenticated low-privileged users can bypass authorization checks in GLPI through 12.0.0 via the ajax/map.php endpoint, disclosing match counts, titles, and coordinates of itemtypes such as Contact, Supplier, Contract, and Budget within their entities. This missing authorization (CWE-862) is a low-severity information-disclosure issue, as per our independent assessment; no public exploit has been identified at time of analysis, and the CVSS 3.1 vector indicates limited confidentiality impact (C:L) with no integrity or availability impact. Affected users must be authenticated with at least low privileges (PR:L) and network access to the endpoint.
Broken access control in GLPI's knowledge-base comment and translation handling lets any authenticated low-privilege user create, update, or delete comments and translations attached to knowledge base items they are not authorized to modify. The affected endpoints (front/knowbaseitem_comment.form.php and front/knowbaseitemtranslation.form.php) perform no per-item permission check, so a valid session with minimal rights is enough; no user interaction, elevated role, or unusual configuration is required, though an account is mandatory and the impact is limited to the integrity of KB comment/translation records (no disclosure, no code execution, no availability loss). The issue is fixed in GLPI 11.0.8 and 10.0.26; no public exploit code and no confirmed active exploitation were identified at time of analysis, and CVSS 5.3 reflects a low-to-moderate-priority flaw rather than a high-severity one.
Improper authorization in GLPI lets an authenticated administrator who holds the delegated 'Update auth and sync' or 'Update auth, sync and 2FA' right (User::UPDATEAUTHENT) change the authentication method and disable two-factor authentication for user accounts that lie outside that administrator's own entity scope. The weakness affects GLPI from 0.84 up to (but not including) 10.0.26, and the 11.x line from 11.0.0 up to but not including 11.0.8; it is only meaningful in multi-entity installations, since in single-entity deployments the administrator already legitimately controls every account. The impact is bounded to authentication-method changes and 2FA toggling rather than arbitrary account modification, vendor-released patches are available in 10.0.26 and 11.0.8, and no public exploit code has been identified at time of analysis.
Authenticated GLPI users who lack configuration-update privileges can enable the application's debug mode on versions 0.72 through 10.0.25 and 11.0.0 through 11.0.7 by injecting a use_mode parameter into the user-setting update endpoint, which pre-patch code failed to gate behind the Config::canUpdate() check. Successful abuse exposes debug-level diagnostic output that a legitimate low-privilege account should not be able to trigger, resulting in limited confidentiality impact; the flaw does not allow data modification or code execution. No public exploit code has been identified at time of analysis and there is no indication of active exploitation, though a vendor fix is available in GLPI 10.0.26 and 11.0.8. NVD rates the issue 5.3 (CVSS 4.0), and the independent assessment concurs that this is a low-to-moderate authorization weakness given the mandatory authentication prerequisite and confined information-exposure impact.
Missing authorization enforcement in GLPI's REST API v2 (the 'HL' API) lets a low-privileged authenticated user perform ticket team-member add/remove/list operations and entity transfers that the web interface would deny, because the API update flow does not re-apply per-object and per-right checks. Only GLPI 11.0.0 through 11.0.7 are affected - API v2 exists only in the 11.x line - and exploitation requires a valid, working low-privileged account using the API rather than the UI (authentication required, PR:L in both the vendor CVSS 4.0 vector and our assessed CVSS 3.1 vector). Impact is integrity-dominant (I:H) with limited confidentiality/availability effects; a vendor patch is available in 11.0.8 and no public exploit code or confirmed active exploitation was identified at time of analysis.
LDAP filter bypass in GLPI versions prior to 10.0.26 and 11.0.8 allows an authenticated hotliner or technician with access to the user-import feature to inject crafted criteria and read LDAP objects that the configured default filter was intended to exclude. The issue is a limited information-disclosure flaw: it does not grant write access, code execution, or access to GLPI's own data, and exploitation requires an existing LDAP integration with a configured default filter. No public exploit code was identified at time of analysis, and NVD rates it CVSS 4.6.
Authorization bypass in GLPI 11.0.5 through 11.0.7 exposes restricted documents to unauthorized network-based access via a manipulable docid parameter in the document download handler. The vulnerability resides in the Document::canViewFile authorization check within front/document.send.php, where an attacker can tamper with the docid argument to circumvent document-level access controls and retrieve files they are not permitted to view. No public exploit has been identified at time of analysis, and EPSS data was not provided; however, the remote network vector with no required privileges raises concern for exposed GLPI deployments.
Arbitrary file read within GLPI_DOC_DIR is exploitable by authenticated technicians in GLPI versions 0.50 through 10.0.24 and 11.0.0 through 11.0.6, stemming from missing authorization controls (CWE-862) on document directory access. An attacker holding a technician-level account can read any file stored under the GLPI_DOC_DIR path without appropriate privilege checks, exposing potentially sensitive documents, attachments, or internal data. No public exploit is identified at time of analysis, and CISA's SSVC framework rates exploitation as none with non-automatable attack paths.
Unauthorized form structure disclosure in GLPI 11.0.0 through 11.0.6 allows a high-privileged authenticated user holding forms READ permission to export the structural definition of forms they are not authorized to access. The flaw, rooted in CWE-862 (Missing Authorization), means the application validates that a user can perform form exports in general but fails to verify per-form access entitlements before returning structure data. Impact is limited to low confidentiality exposure of form schemas with no integrity or availability consequence. No public exploit code or CISA KEV listing exists at time of analysis, and the vendor has released a confirmed fix in 11.0.7.
Stored cross-site scripting (XSS) in GLPI asset management software allows authenticated technician-level users to inject malicious JavaScript into supplier fields, achieving code execution in victim browsers with high confidentiality, integrity, and availability impact. Affects GLPI versions 0.60 through 10.0.23, patched in version 10.0.24. EPSS data not available; no public exploit identified at time of analysis, and not listed in CISA KEV. The CVSS score of 7.2 reflects network-accessible attack requiring high privileges but no user interaction, making this a medium-priority issue for organizations running vulnerable GLPI instances with multiple technician accounts.
GLPI versions 11.0.0 through 11.0.5 contain an authentication bypass vulnerability that allows an attacker with knowledge of a user's credentials to circumvent multi-factor authentication (MFA) and gain unauthorized account access. This vulnerability affects the GLPI asset and IT management software and is classified as CWE-287 (Improper Authentication), with a CVSS score of 6.5 indicating medium severity. The issue has been patched in version 11.0.6, and while no active KEV listing or public proof-of-concept is noted in available sources, the authentication bypass nature suggests moderate exploitation probability.
GLPI versions 11.0.0 through 11.0.5 contain an authenticated SQL injection vulnerability that allows authenticated users to read sensitive database contents without modification or denial-of-service capabilities. The vulnerability affects the free Asset and IT management software package GLPI and is resolved in version 11.0.6. While the CVSS score of 6.5 reflects moderate severity, the impact is limited to confidentiality breach due to the read-only nature of the exploit and the requirement for prior authentication.
GLPI versions 0.71 through 10.0.22 and 11.0.4 are vulnerable to session hijacking when SSO-based remote authentication is enabled, allowing a local attacker to impersonate another user by stealing an active session on the same machine. An authenticated attacker with local access can exploit this by leveraging SSO variables to gain unauthorized access to victim sessions without requiring elevated privileges. No patch is currently available for this vulnerability.
GLPI versions 11.0.0 through 11.0.4 allow authenticated administrators to conduct Server-Side Request Forgery (SSRF) attacks via the Webhook functionality, potentially enabling reconnaissance of internal network resources. An attacker with administrative privileges could leverage this capability to probe internal services or bypass network access controls. A patch is available in version 11.0.5 and later.
Authenticated users in GLPI versions 0.85 through 10.0.22 can exploit a SQL injection vulnerability to read sensitive data from the application database. The vulnerability requires valid credentials and network access but does not allow data modification or denial of service. Version 10.0.23 contains the fix, though no patch is currently available for affected deployments.
GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. [CVSS 7.5 HIGH]
GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). [CVSS 7.5 HIGH]
GLPI versions 9.1.0 through 10.0.20 fail to apply knowledge base visibility restrictions on search and read operations, allowing an API caller to retrieve knowledge base entries that their user, group, profile, or entity permissions should not expose. Exploitation requires valid API access credentials (PR:L in the assessed vector), and the impact is limited to unauthorized read of knowledge base content with no write, modification, or denial-of-service effect. No public exploit code was identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS is very low at 0.22% (11th percentile), and a vendor patch is available in version 10.0.21.
Unauthenticated stored cross-site scripting in GLPI 10.0.0 through 10.0.20 lets a remote attacker push a persistent XSS payload into the inventory ingestion endpoint, which then executes in the browser of any authenticated user who later renders the poisoned inventory record in the web UI. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, and EPSS is low at 0.29% (20th percentile); however, the credential-free write path combined with execution inside a privileged user session makes this a moderate-priority issue whose practical concern exceeds its 6.5 base score. The vendor shipped a fix in GLPI 10.0.21.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. No vendor patch available.
GLPI IT asset management platform contains an unauthenticated SQL injection through the inventory endpoint. Attackers can extract the entire GLPI database including asset inventories, user credentials, helpdesk tickets, and IT infrastructure documentation without any authentication.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in GLPI up to 10.0.17. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GLPI is a free asset and IT management software package. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free Asset and IT management software package. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI is a Free Asset and IT Management Software package. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GLPI is a Free Asset and IT Management Software package. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GLPI is a Free Asset and IT Management Software package. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
GLPI is a free asset and IT management software package. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GLPI is a free asset and IT management software package. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
GLPI is a free asset and IT management software package. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GLPI is a free asset and IT management software package. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.