Filtered by vendor Glpi-project Subscriptions
Filtered by product Glpi Subscriptions

Search

Switch to Advanced Search (Beta)
Total 199 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-42318 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.
CVE-2026-42321 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
CVE-2026-44281 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object. Upgrade to 11.0.7 or 10.0.25 to receive a patch.
CVE-2026-42320 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside the GLPI_DOC_DIR. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
CVE-2026-42317 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
CVE-2026-5385 1 Glpi-project 1 Glpi 2026-06-03 N/A
An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi: before 11.0.7.
CVE-2026-40108 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fixed in version 11.0.7.
CVE-2026-32312 1 Glpi-project 1 Glpi 2026-05-21 4.3 Medium
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7.
CVE-2026-22247 1 Glpi-project 1 Glpi 2026-04-17 4.1 Medium
GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5.
CVE-2026-23624 1 Glpi-project 1 Glpi 2026-04-17 4.3 Medium
GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .
CVE-2026-22044 1 Glpi-project 1 Glpi 2026-04-17 6.5 Medium
GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23.
CVE-2025-53105 1 Glpi-project 1 Glpi 2026-04-15 7.5 High
GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 10.0.0 to before 10.0.19, a connected user without administration rights can change the rules execution order. This issue has been patched in version 10.0.19.
CVE-2026-25932 1 Glpi-project 1 Glpi 2026-04-08 7.2 High
GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.
CVE-2026-26026 1 Glpi-project 1 Glpi 2026-04-08 9.1 Critical
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.
CVE-2026-26027 1 Glpi-project 1 Glpi 2026-04-08 7.5 High
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
CVE-2026-26263 1 Glpi-project 1 Glpi 2026-04-08 8.1 High
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6.
CVE-2026-29047 1 Glpi-project 1 Glpi 2026-04-08 7.2 High
GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6.
CVE-2023-53943 1 Glpi-project 1 Glpi 2026-04-07 5.3 Medium
GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts.
CVE-2026-25936 2 Glpi-project, Teclib-edition 2 Glpi, Glpi 2026-03-24 6.5 Medium
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.
CVE-2026-25937 2 Glpi-project, Teclib-edition 2 Glpi, Glpi 2026-03-24 6.5 Medium
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.