Glpi-Project Glpi vulnerabilities

CVE-2021-21325 [MEDIUM] CWE-79 CVE-2021-21325: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk feat GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a cross-site scripting attack. To exploit this endpoint attacker need to be auth

CVE-2021-21312 [MEDIUM] CWE-79 CVE-2021-21312: GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Fr GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Documents > Add, or /front/document.form.php endpoint), indeed one of the form field: "Web Link

CVE-2022-41941 [MEDIUM] CWE-79 CVE-2022-41941: GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6.

CVE-2022-39277 [MEDIUM] CWE-79 CVE-2022-39277: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Soft GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting (XSS) attack. This issue has been patched, please upgrade to

CVE-2020-27662 [MEDIUM] CWE-639 CVE-2020-27662: In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.).

CVE-2022-39370 [MEDIUM] CWE-284 CVE-2022-39370: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Soft GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI update script. This issue has been patched, please upgrade to 10.0.4. As a workaround, dele

CVE-2026-13490 [LOW] CWE-285 CVE-2026-13490: A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects t A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high comp

CVE-2021-21314 [MEDIUM] CWE-79 CVE-2021-21314: GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Fr GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.

CVE-2023-22724 [MEDIUM] CWE-79 CVE-2023-22724: GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cro GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript.

CVE-2015-7685 [MEDIUM] CWE-264 CVE-2015-7685: GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging pe GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the _profiles_id parameter to front/user.form.php.

CVE-2020-27663 [MEDIUM] CWE-639 CVE-2020-27663: In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulne In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).

CVE-2023-22725 [MEDIUM] CWE-79 CVE-2023-22725: GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 a GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6.

CVE-2012-4003 [MEDIUM] CWE-79 CVE-2012-4003: Multiple cross-site scripting (XSS) vulnerabilities in GLPI-PROJECT GLPI before 0.83.3 allow remote Multiple cross-site scripting (XSS) vulnerabilities in GLPI-PROJECT GLPI before 0.83.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.

CVE-2019-1010310 [LOW] CWE-74 CVE-2019-1010310: GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools > Reminder > Description .. Set the description to any iframe/form tags and apply. The attack

CVE-2025-53113 [LOW] CWE-284 CVE-2025-53113: GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management So GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do not have the right to see. This is