Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

glpi-project Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-13490`glpi-project glpi Document document.send.php canViewFile authorization	Exploitation statusPublic exploit	FixNot confirmed	Affected productglpi	Published06/28/2026	SeverityMedium
`CVE-2026-42321`GLPI has stored XSS in asset locks	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published06/03/2026	SeverityHigh
`CVE-2026-42320`GLPI vulnerable to arbitrary file access	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published06/03/2026	SeverityMedium
`CVE-2026-42318`GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published06/03/2026	SeverityHigh
`CVE-2026-42317`GLPI vulnerable to arbitrary files deletion by technician	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published06/03/2026	SeverityHigh
`CVE-2026-44281`GLPI vulnerable to unauthorized reading of a specific asset object	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published06/03/2026	SeverityHigh
`CVE-2026-40108`GLPI Vulnerable to Stored XSS in ITIL Costs	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published06/02/2026	SeverityHigh
`CVE-2026-5385`GLPI 11.0.0 - Stored XSS in knowledge base	Exploitation statusPublic exploit	FixYes	Affected productglpi	Published06/02/2026	SeverityHigh
`CVE-2026-32312`GLPI: Unauthorized export of form structure	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published05/18/2026	SeverityMedium
`CVE-2026-29047`GLPI has an Authenticated SQL Injection via log exports	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published04/06/2026	SeverityHigh
`CVE-2026-26263`GLPI has an Unauthenticated SQL Injection via Search engine	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published04/06/2026	SeverityHigh
`CVE-2026-26027`GLPI has an Unauthenticated Stored XSS via inventory	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published04/06/2026	SeverityHigh
`CVE-2026-26026`GLPI has a Server-Side Template Injection via Double-Compilation	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published04/06/2026	SeverityCritical
`CVE-2026-25932`GLPI has Stored XSS in Supplier 'Website' field	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published04/06/2026	SeverityHigh
`CVE-2026-26001`GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report	Exploitation statusNot known exploited	FixYes	Affected productglpi-inventory-plugin	Published03/17/2026	SeverityHigh
`CVE-2026-25937`GLPI has a MFA bypass	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published03/17/2026	SeverityMedium
`CVE-2026-25936`GLPI Vulnerable to Authenticated SQL Injection	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published03/17/2026	SeverityMedium
`CVE-2026-22248`GLPI affected by Remote Code Execution via malicious upload	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published03/11/2026	SeverityHigh
`CVE-2026-25590`GLPI Inventory Plugin has Reflected XSS in task jobs	Exploitation statusNot known exploited	FixYes	Affected productglpi-inventory-plugin	Published03/03/2026	SeverityMedium
`CVE-2026-22821`mreporting affected by a SQLI on date change	Exploitation statusNot known exploited	FixYes	Affected productmreporting	Published02/12/2026	SeverityMedium
`CVE-2026-22044`GLPI is Vulnerable to Authenticated SQL Injection	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published02/04/2026	SeverityMedium
`CVE-2026-23624`GLPI is vulnerable to session stealing on externally authenticated user change	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published02/04/2026	SeverityMedium
`CVE-2026-22247`GLPI is Vulnerable to SSRF via Webhooks	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published02/04/2026	SeverityMedium
`CVE-2025-66417`GLPI has an unauthenticated SQL injection through the inventory endpoint	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published01/15/2026	SeverityHigh
`CVE-2025-64516`GLPI incorrectly authorizes access to documents	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published01/15/2026	SeverityHigh
`CVE-2023-53943`GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint	Exploitation statusPublic exploit	FixNot confirmed	Affected productglpi	Published12/18/2025	SeverityMedium
`CVE-2025-64520`GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published12/16/2025	SeverityMedium
`CVE-2025-59935`GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published12/16/2025	SeverityMedium
`CVE-2025-32786`GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection	Exploitation statusNot known exploited	FixYes	Affected productglpi-inventory-plugin	Published11/04/2025	SeverityHigh
`CVE-2025-53105`GLPI permits unauthorized rules execution order	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published08/27/2025	SeverityHigh
`CVE-2025-53357`GLPI permits reservation modification by unauthorized users	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published07/30/2025	SeverityMedium
`CVE-2025-53113`GLPI technicians can access unauthorized information through external links	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published07/30/2025	SeverityLow
`CVE-2025-53112`GLPI's incomprehensive permission checks can lead to data removal from allowed users	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published07/30/2025	SeverityMedium
`CVE-2025-53111`GLPI exposes data to non-allowed users	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published07/30/2025	SeverityMedium
`CVE-2025-53008`GLPI's MailCollector Receiver is vulnerable to credential exfiltration	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published07/30/2025	SeverityMedium
`CVE-2025-52897`GLPI is vulnerable to XSS and open redirection attacks through planning feature	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published07/30/2025	SeverityMedium
`CVE-2025-52567`GLPI has overly permissive URL verification	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published07/30/2025	SeverityLow
`CVE-2025-27514`GLPI is susceptible to Stored XSS attack through project's kanban	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published07/29/2025	SeverityMedium
`CVE-2025-27147`GLPI Inventory plugin has Improper Access Control Vulnerability	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi-inventory-plugin	Published03/25/2025	SeverityHigh
`CVE-2025-24801`GLPI allows authenticated remote code execution	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published03/18/2025	SeverityHigh
`CVE-2025-24799`GLPI allows unauthenticated SQL injection through the inventory endpoint	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published03/18/2025	SeverityHigh
`CVE-2025-21619`GLPI allows SQL injection through the rules configuration	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published03/18/2025	SeverityHigh
`CVE-2025-26626`GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi-inventory-plugin	Published03/14/2025	SeverityMedium
`CVE-2025-25192`GLPI allows unauthorized access to debug mode	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published02/25/2025	SeverityMedium
`CVE-2025-23046`GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published02/25/2025	SeverityMedium
`CVE-2025-23024`GLPI: Plugins are disabled accessing one page	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published02/25/2025	SeverityMedium
`CVE-2025-21627`GLPI Cross-site Scripting vulnerability	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published02/25/2025	SeverityMedium
`CVE-2025-21626`GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published02/25/2025	SeverityMedium
`CVE-2024-11955`GLPI index.php redirect	Exploitation statusPublic exploit	FixYes	Affected productGLPI	Published02/25/2025	SeverityMedium
`CVE-2024-50339`GLPI vulnerable to unauthenticated session hijacking	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published12/11/2024	SeverityCritical
`CVE-2024-48912`GLPI vulnerable to authenticated insecure account deletion	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published12/11/2024	SeverityHigh
`CVE-2024-47761`GLPI vulnerable to account takeover via the password reset feature	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published12/11/2024	SeverityHigh
`CVE-2024-47760`GLPI vulnerable to account takeover via API	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published12/11/2024	SeverityHigh
`CVE-2024-47758`GLPI vulnerable to account takeover without privilege escalation through the API	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published12/11/2024	SeverityHigh
`CVE-2024-43416`GLPI vulnerable to enumeration of users' email addresses by unauthenticated user	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/18/2024	SeverityHigh
`CVE-2024-38370`GLPI allows API document download without rights	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityMedium
`CVE-2024-45611`GLPI has a stored XSS at src/RSSFeed.php	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityMedium
`CVE-2024-45610`GLPI has a reflected XSS in ajax/cable.php	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityMedium
`CVE-2024-45609`GLPI has a Reflected XSS in /front/stat.graph.php	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityMedium
`CVE-2024-45608`GLPI has an Authenticated SQL Injection	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityMedium
`CVE-2024-43418`GLPI has multiple reflected XSS	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityMedium
`CVE-2024-43417`Reflected XSS in Software form	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityMedium
`CVE-2024-41679`Authenticated SQL injection in ticket form	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityMedium
`CVE-2024-41678`GLPI has multiple reflected XSS	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityMedium
`CVE-2024-40638`GLPI allows account takeover via SQL Injection in AJAX scripts	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityHigh
`CVE-2024-47759`GLPI has a stored XSS via document upload	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/15/2024	SeverityMedium
`CVE-2024-37149`GLPI allows remote code execution through the plugin loader	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published07/10/2024	SeverityHigh
`CVE-2024-37148`GLPI allows account takeover via SQL Injection in AJAX scripts	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published07/10/2024	SeverityHigh
`CVE-2024-37147`GLPI allows Authenticated File Upload to Restricted Tickets	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published07/10/2024	SeverityMedium
`CVE-2024-31456`GLPI contains an authenticated SQL injection	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published05/07/2024	SeverityHigh
`CVE-2024-29889`GLPI contains an SQL injection through the saved searches	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published05/07/2024	SeverityHigh
`CVE-2024-28241`GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi-agent	Published04/25/2024	SeverityHigh
`CVE-2024-28240`GLPI-Agent's MSI package installation permits local users to change Agent configuration	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi-agent	Published04/25/2024	SeverityHigh
`CVE-2024-27914`Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published03/18/2024	SeverityMedium
`CVE-2024-27104`Stored XSS in dashboards in GLPI	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published03/18/2024	SeverityMedium
`CVE-2024-27098`Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published03/18/2024	SeverityMedium
`CVE-2024-27096`SQL Injection in through the search engine	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published03/18/2024	SeverityHigh
`CVE-2024-27930`Sensitive fields access through dropdowns in GLPI	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published03/18/2024	SeverityMedium
`CVE-2024-27937`glpi Users emails enumeration	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published03/18/2024	SeverityMedium
`CVE-2024-27756`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published03/15/2024	SeverityHigh
`CVE-2023-51446`GLPI LDAP Injection during authentication	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published02/01/2024	SeverityMedium
`CVE-2024-23645`GLPI reflected XSS in reports pages	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published02/01/2024	SeverityMedium
`CVE-2023-46727`GLPI SQL injection through inventory agent request	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published12/13/2023	SeverityHigh
`CVE-2023-46726`GLPI Remote code execution from LDAP server configuration form on PHP 7.4	Exploitation statusNot confirmed	FixNot confirmed	Affected productglpi	Published12/13/2023	SeverityHigh
`CVE-2023-43813`glpi Authenticated SQL Injection	Exploitation statusNot confirmed	FixNot confirmed	Affected productglpi	Published12/13/2023	SeverityMedium
`CVE-2023-42802`GLPI vulnerable to unallowed PHP script execution	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published11/02/2023	SeverityCritical
`CVE-2023-42462`File deletion through document upload process in GLPI	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published09/26/2023	SeverityHigh
`CVE-2023-42461`SQL injection in ITIL actors in GLPI	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published09/26/2023	SeverityMedium
`CVE-2023-41888`Phishing through a login page malicious URL in GLPI	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published09/26/2023	SeverityMedium
`CVE-2023-41326`Account takeover via Kanban feature in GLPI	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published09/26/2023	SeverityHigh
`CVE-2023-41324`Account takeover through API in GLPI	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published09/26/2023	SeverityHigh
`CVE-2023-41323`Users login enumeration by unauthenticated user in GLPI	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published09/26/2023	SeverityMedium
`CVE-2023-41322`Privilege Escalation from technician to super-admin in GLPI	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published09/26/2023	SeverityMedium
`CVE-2023-41321`Sensitive fields enumeration through API in GLPI	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published09/26/2023	SeverityMedium
`CVE-2023-41320`Account takeover via SQL Injection in UI layout preferences in GLPI	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published09/26/2023	SeverityHigh
`CVE-2023-37278`GLPI vulnerable to SQL injection via dashboard administration	Exploitation statusNot known exploited	FixYes	Affected productglpi	Published07/13/2023	SeverityMedium
`CVE-2023-36808`GLPI vulnerable to SQL injection through Computer Virtual Machine information	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published07/05/2023	SeverityHigh
`CVE-2023-35940`GLPI vulnerable to unauthenticated access to Dashboard data	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published07/05/2023	SeverityHigh
`CVE-2023-35939`GLPI vulnerable to unauthorized access to Dashboard data	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published07/05/2023	SeverityHigh
`CVE-2023-35924`GLPI vulnerable to SQL injection via inventory agent request	Exploitation statusNot known exploited	FixNot confirmed	Affected productglpi	Published07/05/2023	SeverityHigh

100 / 219 Results

Security vulnerabilities from glpi-project

glpi-project

How many security vulnerabilities does glpi-project have?

Which glpi-project product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular glpi-project products

glpi

glpi-inventory-plugin

glpi-agent