Glpi-Project Glpi vulnerabilities

CVE-2017-11474 [CRITICAL] CWE-89 CVE-2017-11474: GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.ph GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php.

CVE-2025-53105 [HIGH] CWE-269 CVE-2025-53105: GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management So GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 10.0.0 to before 10.0.19, a connected user without administration rights can change the rules execution order. This issue has been patched in

CVE-2025-64516 [HIGH] CWE-284 CVE-2025-64516: GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorize GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.

CVE-2023-41323 [MEDIUM] CWE-200 CVE-2023-41323: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software p GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can enumerate users logins. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

CVE-2023-37278 [CRITICAL] CWE-89 CVE-2023-37278: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in version 10.0.9.

CVE-2018-13049 [HIGH] CWE-89 CVE-2018-13049: The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php.

CVE-2017-11475 [HIGH] CWE-89 CVE-2017-11475: GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php.

CVE-2023-22500 [HIGH] CWE-863 CVE-2023-22500: GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by unauthenticated users. This issue is patched in version 10.0.6. As

CVE-2024-27756 [HIGH] CWE-94 CVE-2024-27756: GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a craft GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title.

CVE-2020-15176 [HIGH] CWE-89 CVE-2020-15176: In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version

CVE-2023-35939 [HIGH] CWE-284 CVE-2023-35939: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user (or not for certain actions), allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8 contains a patch for this issue.

CVE-2025-23046 [HIGH] CWE-303 CVE-2025-23046: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.1

CVE-2026-5385 [HIGH] CWE-79 CVE-2026-5385: An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowle An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi: before 11.0.7.

CVE-2024-48912 [HIGH] CWE-284 CVE-2024-48912: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to ver GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue.

CVE-2018-7562 [HIGH] CWE-362 CVE-2018-7562: A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that a A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via front/fileupload.php. This feature is protected using different types of secu

CVE-2023-35940 [HIGH] CWE-284 CVE-2023-35940: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains a patch for this issue.

CVE-2024-47761 [HIGH] CWE-287 CVE-2024-47761: GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to versi GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.

CVE-2026-26026 [HIGH] CWE-94 CVE-2026-26026: GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template inje GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.

CVE-2014-8360 [HIGH] CWE-22 CVE-2014-8360: Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote a Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.

CVE-2024-50339 [MEDIUM] CWE-79 CVE-2024-50339: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.