Filtered by vendor Glpi-project Subscriptions

Search

Switch to Advanced Search (Beta)
Total 217 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-42318 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.
CVE-2026-42321 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
CVE-2026-44281 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object. Upgrade to 11.0.7 or 10.0.25 to receive a patch.
CVE-2026-42320 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside the GLPI_DOC_DIR. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
CVE-2026-42317 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
CVE-2026-5385 1 Glpi-project 1 Glpi 2026-06-03 N/A
An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi: before 11.0.7.
CVE-2026-40108 1 Glpi-project 1 Glpi 2026-06-03 N/A
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fixed in version 11.0.7.
CVE-2026-32312 1 Glpi-project 1 Glpi 2026-05-21 4.3 Medium
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7.
CVE-2026-22247 1 Glpi-project 1 Glpi 2026-04-17 4.1 Medium
GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5.
CVE-2026-23624 1 Glpi-project 1 Glpi 2026-04-17 4.3 Medium
GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .
CVE-2026-22044 1 Glpi-project 1 Glpi 2026-04-17 6.5 Medium
GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23.
CVE-2026-22821 2 Glpi-project, Pluginsglpi 2 More Reporting, Mreporting 2026-04-17 4.9 Medium
mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4.
CVE-2026-25590 1 Glpi-project 1 Glpi Inventory 2026-04-16 4.5 Medium
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6.
CVE-2025-53105 1 Glpi-project 1 Glpi 2026-04-15 7.5 High
GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 10.0.0 to before 10.0.19, a connected user without administration rights can change the rules execution order. This issue has been patched in version 10.0.19.
CVE-2025-32786 1 Glpi-project 1 Glpi Inventory 2026-04-15 7.5 High
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1.
CVE-2025-53360 1 Glpi-project 1 Database Inventory 2026-04-15 4.3 Medium
pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. In versions prior to 1.0.3, any authenticated user could send requests to agents. This issue has been patched in version 1.0.3.
CVE-2026-25932 1 Glpi-project 1 Glpi 2026-04-08 7.2 High
GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.
CVE-2026-26026 1 Glpi-project 1 Glpi 2026-04-08 9.1 Critical
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.
CVE-2026-26027 1 Glpi-project 1 Glpi 2026-04-08 7.5 High
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
CVE-2026-26263 1 Glpi-project 1 Glpi 2026-04-08 8.1 High
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6.