glpi
- Software type
- Business application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, glpi recorded 19 security vulnerabilities in the last 90 days, of which 12 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of glpi and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-57152GLPI: Unallowed notifications sendingCVE-2026-53631GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feedsCVE-2026-52848GLPI: MFA bypassCVE-2026-47678GLPI: Blind Time based SQLI in dropdownsCVE-2026-121559GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-57152GLPI: Unallowed notifications sending | Exploitation statusNot confirmed | FixYes |
| SeverityHigh |
CVE-2026-53631GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds | Exploitation statusNot confirmed | FixYes | Published11/04/2026 | SeverityMedium |
|---|
CVE-2026-52848GLPI: MFA bypass | Exploitation statusNot confirmed | FixYes | Published11/04/2026 | SeverityCritical |
|---|
CVE-2026-47678GLPI: Blind Time based SQLI in dropdowns | Exploitation statusNot confirmed | FixYes | Published11/04/2026 | SeverityHigh |
|---|
CVE-2026-121559GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityHigh |
|---|
CVE-2026-108726GLPI through 12.0.0 Missing Authorization via ajax/map.php | Exploitation statusNot exploited | FixYes | Published10/11/2026 | SeverityMedium |
|---|
CVE-2026-55217GLPI: Unallowed modfication of knowbase items comments and translations | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-55214GLPI: Stored XSS in suppliers | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityHigh |
|---|
CVE-2026-53629GLPI: SQL injection in history tab | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityHigh |
|---|
CVE-2026-53628GLPI: Unallowed authentication method update by administrator | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-53627GLPI: Unexpected access to update operations through the API | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-53626GLPI: Arbitrary Document Read via Form Context Authorization Bypass | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityHigh |
|---|
CVE-2026-53625GLPI: Privilege Escalation via authtype API manipulation | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityHigh |
|---|
CVE-2026-53610Reflected cross-site scripting in glpi-project GLPI dashboards | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityHigh |
|---|
CVE-2026-49470GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityHigh |
|---|
CVE-2026-49469glpi-project GLPI LDAP filter injection bypasses default filtering in user import | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-48482Path traversal enables remote code execution in GLPI | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityCritical |
|---|
CVE-2026-47679GLPI: arbitrary file deletion | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityHigh |
|---|
CVE-2026-45801GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-13490glpi-project glpi Document document.send.php canViewFile authorization | Exploitation statusActively exploited | FixNo | Published06/28/2026 | SeverityMedium |
|---|
CVE-2026-44281GLPI vulnerable to unauthorized reading of a specific asset object | Exploitation statusNot exploited | FixNo | Published06/03/2026 | SeverityHigh |
|---|
CVE-2026-42321GLPI has stored XSS in asset locks | Exploitation statusNot exploited | FixNo | Published06/03/2026 | SeverityHigh |
|---|
CVE-2026-42320GLPI vulnerable to arbitrary file access | Exploitation statusNot exploited | FixNo | Published06/03/2026 | SeverityMedium |
|---|
CVE-2026-42318GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint | Exploitation statusNot exploited | FixNo | Published06/03/2026 | SeverityHigh |
|---|
CVE-2026-42317GLPI vulnerable to arbitrary files deletion by technician | Exploitation statusNot exploited | FixNo | Published06/03/2026 | SeverityHigh |
|---|
CVE-2026-5385GLPI 11.0.0 - Stored XSS in knowledge base | Exploitation statusActively exploited | FixYes | Published06/02/2026 | SeverityHigh |
|---|
CVE-2026-40108GLPI Vulnerable to Stored XSS in ITIL Costs | Exploitation statusNot exploited | FixYes | Published06/02/2026 | SeverityHigh |
|---|
CVE-2026-32312GLPI: Unauthorized export of form structure | Exploitation statusNot exploited | FixYes | Published05/18/2026 | SeverityMedium |
|---|
CVE-2026-29047GLPI has an Authenticated SQL Injection via log exports | Exploitation statusNot exploited | FixYes | Published04/06/2026 | SeverityHigh |
|---|
CVE-2026-26263GLPI has an Unauthenticated SQL Injection via Search engine | Exploitation statusNot exploited | FixYes | Published04/06/2026 | SeverityHigh |
|---|
CVE-2026-26027GLPI has an Unauthenticated Stored XSS via inventory | Exploitation statusNot exploited | FixYes | Published04/06/2026 | SeverityHigh |
|---|
CVE-2026-26026Server-Side Template Injection Enables RCE in glpi-project GLPI | Exploitation statusNot exploited | FixYes | Published04/06/2026 | SeverityCritical |
|---|
CVE-2026-25932GLPI has Stored XSS in Supplier 'Website' field | Exploitation statusNot exploited | FixYes | Published04/06/2026 | SeverityHigh |
|---|
CVE-2026-25937GLPI has a MFA bypass | Exploitation statusNot exploited | FixNo | Published03/17/2026 | SeverityMedium |
|---|
CVE-2026-25936GLPI Vulnerable to Authenticated SQL Injection | Exploitation statusNot exploited | FixNo | Published03/17/2026 | SeverityMedium |
|---|
CVE-2026-22248GLPI affected by Remote Code Execution via malicious upload | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityHigh |
|---|
CVE-2026-23624GLPI is vulnerable to session stealing on externally authenticated user change | Exploitation statusNot exploited | FixYes | Published02/04/2026 | SeverityMedium |
|---|
CVE-2026-22247GLPI is Vulnerable to SSRF via Webhooks | Exploitation statusNot exploited | FixYes | Published02/04/2026 | SeverityMedium |
|---|
CVE-2026-22044GLPI is Vulnerable to Authenticated SQL Injection | Exploitation statusNot exploited | FixYes | Published02/04/2026 | SeverityMedium |
|---|
CVE-2025-66417GLPI has an unauthenticated SQL injection through the inventory endpoint | Exploitation statusNot exploited | FixYes | Published01/15/2026 | SeverityHigh |
|---|
CVE-2025-64516GLPI incorrectly authorizes access to documents | Exploitation statusNot exploited | FixYes | Published01/15/2026 | SeverityHigh |
|---|
CVE-2023-53943GLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint | Exploitation statusActively exploited | FixNo | Published12/18/2025 | SeverityMedium |
|---|
CVE-2025-64520GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API | Exploitation statusNot exploited | FixNo | Published12/16/2025 | SeverityMedium |
|---|
CVE-2025-59935GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page | Exploitation statusNot exploited | FixNo | Published12/16/2025 | SeverityMedium |
|---|
CVE-2025-53105GLPI permits unauthorized rules execution order | Exploitation statusNot exploited | FixYes | Published08/27/2025 | SeverityHigh |
|---|
CVE-2025-53357GLPI permits reservation modification by unauthorized users | Exploitation statusNot exploited | FixYes | Published07/30/2025 | SeverityMedium |
|---|
CVE-2025-53113GLPI technicians can access unauthorized information through external links | Exploitation statusNot exploited | FixYes | Published07/30/2025 | SeverityLow |
|---|
CVE-2025-53112GLPI's incomprehensive permission checks can lead to data removal from allowed users | Exploitation statusNot exploited | FixYes | Published07/30/2025 | SeverityMedium |
|---|
CVE-2025-53111GLPI exposes data to non-allowed users | Exploitation statusNot exploited | FixYes | Published07/30/2025 | SeverityMedium |
|---|
CVE-2025-53008GLPI's MailCollector Receiver is vulnerable to credential exfiltration | Exploitation statusNot exploited | FixYes | Published07/30/2025 | SeverityMedium |
|---|
117 Results | Page 1 of 3