What’s Vulnerable › Products

glpi-project glpi vulnerabilities

212 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 54 published in the last 12 months.

Check whether your glpi-project glpi version is affected

Exploited glpi-project glpi vulnerabilities

• CVE-2022-35914 — Teclib GLPI Remote Code Execution Vulnerability

Latest glpi-project glpi vulnerabilities

• CVE-2026-108726 — GLPI through 12.0.0 Missing Authorization via ajax/map.php (CVSS 4.3)
• CVE-2026-55217 — GLPI: Unallowed modfication of knowbase items comments and translations (CVSS 5.3)
• CVE-2026-55214 — GLPI: Stored XSS in suppliers (CVSS 8.5)
• CVE-2026-53629 — GLPI: SQL injection in history tab (CVSS 7.1)
• CVE-2026-53628 — GLPI: Unallowed authentication method update by administrator (CVSS 5.9)
• CVE-2026-53627 — GLPI: Unexpected access to update operations through the API (CVSS 6.0)
• CVE-2026-53626 — GLPI: Arbitrary Document Read via Form Context Authorization Bypass (CVSS 7.1)
• CVE-2026-53625 — GLPI: Privilege Escalation via authtype API manipulation (CVSS 7.5)
• CVE-2026-53610 — GLPI: Reflected XSS in dashboards (CVSS 7.5)
• CVE-2026-49470 — GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force (CVSS 7.7)
• CVE-2026-49469 — GLPI: LDAP filter injection in user import feature (CVSS 4.6)
• CVE-2026-48482 — GLPI: RCE via Form import (CVSS 9.4)
• CVE-2026-47679 — GLPI: arbitrary file deletion (CVSS 8.5)
• CVE-2026-45801 — GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) (CVSS 5.3)
• CVE-2026-13490 — glpi-project glpi Document document.send.php canViewFile authorization (CVSS 3.7)
• CVE-2026-44281 — GLPI vulnerable to unauthorized reading of a specific asset object (CVSS 7.0)
• CVE-2026-42321 — GLPI has stored XSS in asset locks (CVSS 8.4)
• CVE-2026-42320 — GLPI vulnerable to arbitrary file access (CVSS 5.9)
• CVE-2026-42318 — GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint (CVSS 7.0)
• CVE-2026-42317 — GLPI vulnerable to arbitrary files deletion by technician (CVSS 7.0)
• CVE-2026-40108 — GLPI Vulnerable to Stored XSS in ITIL Costs (CVSS 7.1)
• CVE-2026-5385 — GLPI 11.0.0 - Stored XSS in knowledge base (CVSS 8.4)
• CVE-2026-32312 — GLPI: Unauthorized export of form structure (CVSS 4.3)
• CVE-2026-29047 — GLPI has an Authenticated SQL Injection via log exports (CVSS 8.8)
• CVE-2026-26263 — GLPI has an Unauthenticated SQL Injection via Search engine (CVSS 9.8)