Glpi-Project Glpi vulnerabilities

CVE-2019-13239 [MEDIUM] CWE-79 CVE-2019-13239: inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture. inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.

CVE-2020-11036 [MEDIUM] CWE-79 CVE-2020-11036: In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is v In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "alert(1)" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by a

CVE-2012-1105 [MEDIUM] CVE-2012-1105: An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1 An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.

CVE-2021-21258 [MEDIUM] CWE-79 CVE-2021-21258: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk feat GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4.

CVE-2025-64520 [MEDIUM] CWE-862 CVE-2025-64520: GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.

CVE-2022-21719 [MEDIUM] CWE-79 CVE-2022-21719: GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulner GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.

CVE-2014-5032 [MEDIUM] CWE-264 CVE-2014-5032: GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attack GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information via the cost criteria in the search bar.

CVE-2020-11062 [MEDIUM] CWE-79 CVE-2020-11062: In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.

CVE-2026-32312 [MEDIUM] CWE-862 CVE-2026-32312: GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authe GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7.

CVE-2025-53112 [MEDIUM] CWE-284 CVE-2025-53112: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, l GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.19.

CVE-2016-7509 [MEDIUM] CWE-79 CVE-2016-7509: Cross-site scripting (XSS) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inj Cross-site scripting (XSS) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket.

CVE-2024-27104 [MEDIUM] CWE-79 CVE-2024-27104: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version

CVE-2023-28636 [MEDIUM] CWE-79 CVE-2023-28636: GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versi GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7.

CVE-2023-28852 [MEDIUM] CWE-79 CVE-2023-28852: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users will use the related dashboard. Versions 9.5.13 and 10.0.7 contain a patch for this issue.

CVE-2022-39373 [MEDIUM] CWE-79 CVE-2022-39373: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Soft GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Administrator may store malicious code in entity name. This issue has been patched, please upgrade to version 10.0.4.

CVE-2024-47759 [MEDIUM] CWE-79 CVE-2024-47759: GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then be executed when any user will try to see the document contents. Upgrade to 10.0.17.

CVE-2026-25932 [MEDIUM] CWE-79 CVE-2026-25932: GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticat GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.

CVE-2024-37147 [MEDIUM] CWE-284 CVE-2024-37147: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk feat GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16.

CVE-2025-23024 [MEDIUM] CWE-285 CVE-2025-23024: GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to versi GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.

CVE-2022-39262 [MEDIUM] CWE-83 CVE-2022-39262: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Soft GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4.