Glpi Project Security Vulnerabilities (CVEs)
Track 52 security vulnerabilities affecting Glpi Project products and software. Get instant email alerts when new CVEs are discovered, automated security monitoring, and patch guidance.
The mreporting GLPI plugin before version 1.9.4 contains a SQL injection vulnerability in date change functionality. This allows authenticated attacke...
Feb 12, 2026This vulnerability allows authenticated users in GLPI (an IT management software) to perform SQL injection attacks. It affects all GLPI installations ...
Feb 4, 2026GLPI administrators can exploit a Server-Side Request Forgery (SSRF) vulnerability through the Webhook feature, allowing them to make unauthorized req...
Feb 4, 2026This vulnerability in GLPI allows session hijacking when remote authentication via SSO is used. An attacker on the same machine can steal another user...
Feb 4, 2026CVE-2025-66417 is an unauthenticated SQL injection vulnerability in GLPI's inventory endpoint. Attackers can execute arbitrary SQL commands without cr...
Jan 15, 2026This vulnerability allows unauthorized users to access documents attached to any item in GLPI (tickets, assets, etc.). If the public FAQ feature is en...
Jan 15, 2026CVE-2023-53943 is a username enumeration vulnerability in GLPI's password recovery mechanism that allows attackers to determine valid user email addre...
Dec 18, 2025This vulnerability allows unauthorized users with API access to read all knowledge base entries in GLPI software. It affects GLPI installations from v...
Dec 16, 2025This vulnerability in GLPI allows authenticated users to modify other users' reservations, potentially disrupting IT asset management and service desk...
Jul 30, 2025CVE-2025-53112 is an improper access control vulnerability in GLPI that allows unauthorized users to delete specific resources. This affects GLPI inst...
Jul 30, 2025GLPI versions 9.1.0 through 10.0.18 contain a vulnerability in the planning feature that allows unauthenticated attackers to craft malicious links for...
Jul 30, 2025GLPI versions 9.5.0 through 10.0.18 contain a stored cross-site scripting (XSS) vulnerability in the project kanban feature. Authenticated technicians...
Jul 29, 2025This vulnerability allows authenticated GLPI users to upload and execute arbitrary PHP files on the server, leading to remote code execution. It affec...
Mar 18, 2025This SQL injection vulnerability in GLPI allows administrator users to execute arbitrary SQL commands through rules configuration forms. Attackers wit...
Mar 18, 2025This vulnerability allows authentication bypass in GLPI when using OauthIMAP plugin with Mail servers authentication. Anyone can connect using any use...
Feb 25, 2025CVE-2025-25192 allows low-privileged users in GLPI to enable debug mode, potentially exposing sensitive system information. This affects GLPI installa...
Feb 25, 2025This CVE describes an open redirect vulnerability in GLPI versions up to 10.0.17. Attackers can manipulate the 'redirect' parameter in /index.php to r...
Feb 25, 2025GLPI versions before 10.0.18 contain a reflected cross-site scripting (XSS) vulnerability on the search page. Attackers can craft malicious links to e...
Feb 25, 2025This vulnerability in GLPI allows authenticated users to delete any user account via a specific application endpoint. It affects GLPI versions 10.0.0 ...
Dec 11, 2024GLPI versions 9.1.0 through 10.0.16 contain an API vulnerability where authenticated technicians can escalate privileges to higher-level accounts. Thi...
Dec 11, 2024This vulnerability in GLPI allows authenticated users to take control of other user accounts with equal or lower privilege levels via API exploitation...
Dec 11, 2024This vulnerability allows unauthenticated attackers to determine whether specific email addresses correspond to valid GLPI user accounts. It affects G...
Nov 18, 2024This vulnerability in GLPI allows unauthorized users to download documents via the API without proper authentication. It affects GLPI installations ru...
Nov 15, 2024This vulnerability allows authenticated GLPI users to bypass access controls and create private RSS feeds attached to other user accounts. Attackers c...
Nov 15, 2024This SQL injection vulnerability in GLPI allows authenticated users to execute arbitrary SQL commands by manipulating their preference settings. The a...
Nov 15, 2024CVE-2024-43417 is a reflected cross-site scripting (XSS) vulnerability in GLPI's Software form that allows unauthenticated attackers to inject malicio...
Nov 15, 2024This SQL injection vulnerability in GLPI allows authenticated users to execute arbitrary SQL queries. An attacker could modify other user accounts to ...
Nov 15, 2024Authenticated technician users in GLPI can upload malicious PHP scripts and hijack the plugin loader to execute arbitrary code. This affects GLPI inst...
Jul 10, 2024CVE-2024-29889 is a SQL injection vulnerability in GLPI's saved searches feature that allows authenticated users to modify other user accounts and pot...
May 7, 2024This vulnerability in GLPI Agent on Windows allows local users to cause denial of service by modifying the GLPI server URL or disabling the service. I...
Apr 25, 2024CVE-2024-27096 is a SQL injection vulnerability in GLPI's search engine that allows authenticated users to extract sensitive data from the database. T...
Mar 18, 2024CVE-2024-27756 is a CSV injection vulnerability in GLPI that allows attackers to embed malicious formulas in asset titles. When exported to CSV and op...
Mar 15, 2024This vulnerability allows authenticated attackers to execute arbitrary code on GLPI servers running PHP 7.4 by exploiting the LDAP server configuratio...
Dec 13, 2023This critical vulnerability in GLPI allows attackers to upload malicious PHP files to unauthorized directories through unverified object instantiation...
Nov 2, 2023CVE-2023-42462 is a path traversal vulnerability in GLPI's document upload functionality that allows attackers to delete arbitrary files on the server...
Sep 27, 2023This SQL injection vulnerability in GLPI's UI layout preferences management allows attackers to execute arbitrary SQL commands. Successful exploitatio...
Sep 27, 2023This vulnerability in GLPI allows API users with read-only access to user resources to steal other users' accounts by exploiting improper privilege ma...
Sep 27, 2023This SQL injection vulnerability in GLPI allows attackers to execute arbitrary SQL commands through the Computer Virtual Machine form and inventory re...
Jul 5, 2023This vulnerability in GLPI allows authenticated users (and in some cases unauthenticated users) to bypass access controls and interact with, modify, o...
Jul 5, 2023This vulnerability allows unauthenticated attackers to perform SQL injection attacks against GLPI's inventory endpoint. All GLPI installations running...
Jul 5, 2023CVE-2023-34254 is a command injection vulnerability in GLPI Agent that allows authenticated remote administrators to execute arbitrary commands on Uni...
Jun 23, 2023CVE-2022-34126 is a directory traversal vulnerability in the Activity plugin for GLPI that allows attackers to read local files on the server. This af...
Apr 16, 2023This vulnerability allows remote attackers to execute arbitrary PHP code on GLPI servers running vulnerable versions of the Cartography (positions) pl...
Apr 16, 2023This SQL injection vulnerability in GLPI allows authenticated users with statistics or reports access rights to execute arbitrary SQL queries. Attacke...
Apr 5, 2023This vulnerability in the Order GLPI plugin allows authenticated users with standard interface access to execute arbitrary system commands via a craft...
Apr 5, 2023This vulnerability allows a user with Technician profile in GLPI to generate a personal token for a Super-Admin account, enabling privilege escalation...
Apr 5, 2023This vulnerability allows authenticated GLPI users to modify any user's email address, enabling account takeover through password reset functionality ...
Apr 5, 2023CVE-2022-31056 is a critical SQL injection vulnerability in GLPI's assistance forms (Ticket/Change/Problem) that allows attackers to execute arbitrary...
Jun 28, 2022CVE-2022-24867 is an information disclosure vulnerability in GLPI where the LDAP password is exposed in rendered page source code due to insufficient ...
Apr 21, 2022This CVE describes a SQL injection vulnerability in the Ramo plugin for GLPI 9.4.6 that allows attackers to execute arbitrary SQL commands via the idu...
Mar 28, 2022Why Monitor Glpi Project Security Vulnerabilities?
Real-time CVE tracking: Our automated system monitors 52+ known vulnerabilities affecting Glpi Project products and software packages. Stay ahead of emerging threats with instant email notifications when new security issues are discovered.
Automated security monitoring: Unlike manual CVE checking, FixTheCVE automatically scans your servers and detects vulnerable Glpi Project packages in under 60 seconds. No agents required - completely agentless scanning that works across Glpi Project deployments.
Free vulnerability database: Access detailed information about every Glpi Project CVE including CVSS scores, severity ratings, affected versions, and actionable patch guidance. Filter by critical, high, medium, or low severity to prioritize your security remediation efforts.
🚀 Get Started in 60 Seconds
- Register free account & add your servers
- Run one-time scan or schedule automatic monitoring (every 1-24 hours)
- Receive instant alerts when new Glpi Project CVEs affect your systems
- Access dashboard with severity breakdown & fix instructions
