glpi
- Software type
- Business application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, glpi recorded 19 security vulnerabilities in the last 90 days, of which 12 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of glpi and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2025-52897GLPI is vulnerable to XSS and open redirection attacks through planning featureCVE-2025-52567GLPI has overly permissive URL verificationCVE-2025-27514GLPI is susceptible to Stored XSS attack through project's kanbanCVE-2025-24801GLPI allows authenticated remote code executionCVE-2025-24799GLPI allows unauthenticated SQL injection through the inventory endpoint| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2025-52897GLPI is vulnerable to XSS and open redirection attacks through planning feature | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2025-52567GLPI has overly permissive URL verification | Exploitation statusNot exploited | FixYes | Published07/30/2025 | SeverityLow |
|---|
CVE-2025-27514GLPI is susceptible to Stored XSS attack through project's kanban | Exploitation statusNot exploited | FixYes | Published07/29/2025 | SeverityMedium |
|---|
CVE-2025-24801GLPI allows authenticated remote code execution | Exploitation statusNot exploited | FixYes | Published03/18/2025 | SeverityHigh |
|---|
CVE-2025-24799GLPI allows unauthenticated SQL injection through the inventory endpoint | Exploitation statusNot exploited | FixYes | Published03/18/2025 | SeverityHigh |
|---|
CVE-2025-21619GLPI allows SQL injection through the rules configuration | Exploitation statusNot exploited | FixYes | Published03/18/2025 | SeverityHigh |
|---|
CVE-2025-25192GLPI allows unauthorized access to debug mode | Exploitation statusNot exploited | FixNo | Published02/25/2025 | SeverityMedium |
|---|
CVE-2025-23046GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin | Exploitation statusNot exploited | FixNo | Published02/25/2025 | SeverityMedium |
|---|
CVE-2025-23024GLPI: Plugins are disabled accessing one page | Exploitation statusNot exploited | FixNo | Published02/25/2025 | SeverityMedium |
|---|
CVE-2025-21627GLPI Cross-site Scripting vulnerability | Exploitation statusNot exploited | FixNo | Published02/25/2025 | SeverityMedium |
|---|
CVE-2025-21626GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint | Exploitation statusNot exploited | FixNo | Published02/25/2025 | SeverityMedium |
|---|
CVE-2024-50339GLPI vulnerable to unauthenticated session hijacking | Exploitation statusNot exploited | FixNo | Published12/11/2024 | SeverityCritical |
|---|
CVE-2024-48912GLPI vulnerable to authenticated insecure account deletion | Exploitation statusNot exploited | FixNo | Published12/11/2024 | SeverityHigh |
|---|
CVE-2024-47761GLPI vulnerable to account takeover via the password reset feature | Exploitation statusNot exploited | FixNo | Published12/11/2024 | SeverityHigh |
|---|
CVE-2024-47760GLPI vulnerable to account takeover via API | Exploitation statusNot exploited | FixNo | Published12/11/2024 | SeverityHigh |
|---|
CVE-2024-47758GLPI vulnerable to account takeover without privilege escalation through the API | Exploitation statusNot exploited | FixNo | Published12/11/2024 | SeverityHigh |
|---|
CVE-2024-43416GLPI vulnerable to enumeration of users' email addresses by unauthenticated user | Exploitation statusNot exploited | FixNo | Published11/18/2024 | SeverityHigh |
|---|
CVE-2024-47759GLPI has a stored XSS via document upload | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-45611GLPI has a stored XSS at src/RSSFeed.php | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-45610GLPI has a reflected XSS in ajax/cable.php | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-45609GLPI has a Reflected XSS in /front/stat.graph.php | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-45608GLPI has an Authenticated SQL Injection | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-43418GLPI has multiple reflected XSS | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-43417Reflected XSS in Software form | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-41679Authenticated SQL injection in ticket form | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-41678GLPI has multiple reflected XSS | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-40638GLPI allows account takeover via SQL Injection in AJAX scripts | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityHigh |
|---|
CVE-2024-38370GLPI allows API document download without rights | Exploitation statusNot exploited | FixNo | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-37149GLPI allows remote code execution through the plugin loader | Exploitation statusNot exploited | FixNo | Published07/10/2024 | SeverityHigh |
|---|
CVE-2024-37148GLPI allows account takeover via SQL Injection in AJAX scripts | Exploitation statusNot exploited | FixNo | Published07/10/2024 | SeverityHigh |
|---|
CVE-2024-37147GLPI allows Authenticated File Upload to Restricted Tickets | Exploitation statusNot exploited | FixNo | Published07/10/2024 | SeverityMedium |
|---|
CVE-2024-31456GLPI contains an authenticated SQL injection | Exploitation statusNot exploited | FixYes | Published05/07/2024 | SeverityHigh |
|---|
CVE-2024-29889GLPI contains an SQL injection through the saved searches | Exploitation statusNot exploited | FixYes | Published05/07/2024 | SeverityHigh |
|---|
CVE-2024-27937glpi Users emails enumeration | Exploitation statusNot exploited | FixYes | Published03/18/2024 | SeverityMedium |
|---|
CVE-2024-27930Sensitive fields access through dropdowns in GLPI | Exploitation statusNot exploited | FixYes | Published03/18/2024 | SeverityMedium |
|---|
CVE-2024-27914Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI | Exploitation statusNot exploited | FixYes | Published03/18/2024 | SeverityMedium |
|---|
CVE-2024-27104Stored XSS in dashboards in GLPI | Exploitation statusNot exploited | FixYes | Published03/18/2024 | SeverityMedium |
|---|
CVE-2024-27098Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI | Exploitation statusNot exploited | FixYes | Published03/18/2024 | SeverityMedium |
|---|
CVE-2024-27096SQL Injection in through the search engine | Exploitation statusNot exploited | FixYes | Published03/18/2024 | SeverityHigh |
|---|
CVE-2024-23645GLPI reflected XSS in reports pages | Exploitation statusNot exploited | FixNo | Published02/01/2024 | SeverityMedium |
|---|
CVE-2023-51446GLPI LDAP Injection during authentication | Exploitation statusNot exploited | FixNo | Published02/01/2024 | SeverityMedium |
|---|
CVE-2023-46727GLPI SQL injection through inventory agent request | Exploitation statusNot exploited | FixNo | Published12/13/2023 | SeverityHigh |
|---|
CVE-2023-46726GLPI Remote code execution from LDAP server configuration form on PHP 7.4 | Exploitation statusNot confirmed | FixNo | Published12/13/2023 | SeverityHigh |
|---|
CVE-2023-43813glpi Authenticated SQL Injection | Exploitation statusNot confirmed | FixNo | Published12/13/2023 | SeverityMedium |
|---|
CVE-2023-42802GLPI vulnerable to unallowed PHP script execution | Exploitation statusNot exploited | FixNo | Published11/02/2023 | SeverityCritical |
|---|
CVE-2023-42462File deletion through document upload process in GLPI | Exploitation statusNot exploited | FixNo | Published09/26/2023 | SeverityHigh |
|---|
CVE-2023-42461SQL injection in ITIL actors in GLPI | Exploitation statusNot exploited | FixNo | Published09/26/2023 | SeverityMedium |
|---|
CVE-2023-41888Phishing through a login page malicious URL in GLPI | Exploitation statusNot exploited | FixNo | Published09/26/2023 | SeverityMedium |
|---|
CVE-2023-41326Account takeover via Kanban feature in GLPI | Exploitation statusNot exploited | FixNo | Published09/26/2023 | SeverityHigh |
|---|
CVE-2023-41324Account takeover through API in GLPI | Exploitation statusNot exploited | FixNo | Published09/26/2023 | SeverityHigh |
|---|
117 Results | Page 2 of 3