GL
Product
glpi
On CISA KEVExploited in the wild
215
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 28High 64Medium 108Low 3
Watch
Add glpi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25937 | 6.5 | Mar 17 | GLPI has a MFA bypass Affected: >= 11.0.0, < 11.0.6 |
| CVE-2026-23624 | 6.5 | Feb 4 | GLPI is vulnerable to session stealing on externally authenticated user change Affected: >= 0.71, < 10.0.23; >= 11.0.0-alpha, < 11.0.5 |
| CVE-2025-59935 | 6.5 | Dec 16 | GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page Affected: >= 10.0.0, < 10.0.21 |
| CVE-2025-53111 | 6.5 | Jul 30 | GLPI exposes data to non-allowed users Affected: >= 0.80, < 10.0.19 |
| CVE-2025-53008 | 6.5 | Jul 30 | GLPI's MailCollector Receiver is vulnerable to credential exfiltration Affected: >= 9.3.1, < 10.0.19 |
| CVE-2025-25192 | 6.5 | Feb 25 | GLPI allows unauthorized access to debug mode Affected: < 10.0.18 |
| CVE-2025-21626 | 6.5 | Feb 25 | GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint Affected: >= 0.71, < 10.0.18 |
| CVE-2024-31456 | 6.5 | May 7 | GLPI contains an authenticated SQL injection Affected: < 10.0.15 |
| CVE-2024-27096 | 6.5 | Mar 18 | SQL Injection in through the search engine Affected: >= 0.65, < 10.0.13 |
| CVE-2024-27930 | 6.5 | Mar 18 | Sensitive fields access through dropdowns in GLPI Affected: >= 0.78, < 10.0.13 |
| CVE-2023-41321 | 6.5 | Sep 26 | Sensitive fields enumeration through API in GLPI Affected: >= 9.1.1, < 10.0.10 |
| CVE-2023-34107 | 6.5 | Jul 5 | GLPI vulnerable to unauthorized access to KnowbaseItem data Affected: >= 9.2.0, < 10.0.8 |
| CVE-2023-34106 | 6.5 | Jul 5 | GLPI vulnerable to unauthorized access to User data Affected: >= 0.68, < 10.0.8 |
| CVE-2023-23610 | 6.5 | Jan 26 | GLPI is a Free Asset and IT Management Software package Affected: 0.65 before 9.5.12; 10.0.0 before 10.0.6 |
| CVE-2022-39376 | 6.5 | Nov 3 | Improper input validation on emails links in GLPI Affected: >= 0.65, < 10.0.4 |
| CVE-2022-35946 | 6.5 | Sep 14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 10.0.3 |
| CVE-2022-29250 | 6.5 | Jun 9 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0 |
| CVE-2021-39210 | 6.5 | Sep 15 | GLPI is a free Asset and IT management software package Affected: before 9.5.6 |
| CVE-2021-21326 | 6.5 | Mar 8 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: before 9.5.4 |
| CVE-2021-21324 | 6.5 | Mar 8 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: before 9.5.4 |
| CVE-2020-26212 | 6.5 | Nov 25 | GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 9.5.3 |
| CVE-2026-26027 | 6.1 | Apr 6 | GLPI has an Unauthenticated Stored XSS via inventory Affected: >= 11.0.0, < 11.0.6 |
| CVE-2025-52897 | 6.1 | Jul 30 | GLPI is vulnerable to XSS and open redirection attacks through planning feature Affected: >= 9.1.0, < 10.0.19 |
| CVE-2025-21627 | 6.1 | Feb 25 | GLPI Cross-site Scripting vulnerability Affected: < 10.0.18 |
| CVE-2024-11955 | 6.1 | Feb 25 | GLPI index.php redirect Affected: 0.85 before 10.0.18 |
| CVE-2024-45610 | 6.1 | Nov 15 | GLPI has a reflected XSS in ajax/cable.php Affected: >= 10.0.0, < 10.0.17 |
| CVE-2024-45609 | 6.1 | Nov 15 | GLPI has a Reflected XSS in /front/stat.graph.php Affected: >= 0.70, < 10.0.17 |
| CVE-2024-43418 | 6.1 | Nov 15 | GLPI has multiple reflected XSS Affected: >= 0.65, < 10.0.17 |
| CVE-2024-43417 | 6.1 | Nov 15 | Reflected XSS in Software form Affected: >= 10.0.0, < 10.0.17 |
| CVE-2024-41678 | 6.1 | Nov 15 | GLPI has multiple reflected XSS Affected: >= 0.50, < 10.0.17 |
| CVE-2024-27914 | 6.1 | Mar 18 | Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI Affected: >= 10.0.8, < 10.0.13 |
| CVE-2024-23645 | 6.1 | Feb 1 | GLPI reflected XSS in reports pages Affected: >= 0.65, < 10.0.12 |
| CVE-2023-34244 | 6.1 | Jul 5 | GLPI vulnerable to reflected XSS in search pages Affected: >= 9.4.0, < 10.0.8 |
| CVE-2023-28639 | 6.1 | Apr 5 | GLPI is a free asset and IT management software package Affected: 0.85 before 9.5.13; 10.0.0 before 10.0.7 |
| CVE-2023-22722 | 6.1 | Jan 26 | GLPI is a Free Asset and IT Management Software package Affected: 9.4.0 before 9.5.12; 10.0.0 before 10.0.6 |
| CVE-2022-35945 | 6.1 | Sep 14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 10.0.3 |
| CVE-2022-21719 | 6.1 | Jan 28 | GLPI is a free asset and IT management software package Affected: before 9.5.7 |
| CVE-2021-3486 | 6.1 | May 26 | GLPi 9.5.4 does not sanitize the metadata Affected: 9.5.4 |
| CVE-2021-21313 | 6.1 | Mar 3 | GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package Affected: before 9.5.4 |
| CVE-2020-15177 | 6.1 | Oct 7 | In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api` Affected: before 9.5.2 |
| CVE-2020-11034 | 6.1 | May 5 | In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp Affected: before 9.4.6 |
| CVE-2019-13239 | 6.1 | Jul 4 | inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture Affected: 9.1 before 9.4.3 |
| CVE-2018-7563 | 6.1 | Mar 12 | An issue was discovered in GLPI through 9.2.1 Affected: through 9.2.1 |
| CVE-2026-53627 | 6.0 | Sep 25 | GLPI: Unexpected access to update operations through the API Affected: >= 11.0.0, < 11.0.8 |
| CVE-2026-53628 | 5.9 | Sep 25 | GLPI: Unallowed authentication method update by administrator Affected: >= 0.84, < 10.0.26; >= 11.0.0, < 11.0.8 |
| CVE-2026-42320 | 5.9 | Jun 3 | GLPI vulnerable to arbitrary file access Affected: >= 11.0.0, < 11.0.7; >= 0.50, < 10.0.25 |
| CVE-2019-13240 | 5.9 | Jul 10 | An issue was discovered in GLPI before 9.4.1 Affected: before 9.4.1 |
| CVE-2022-36112 | 5.8 | Sep 14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and… Affected: before 10.0.3 |
| CVE-2021-21255 | 5.7 | Mar 2 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing Affected: 9.5.3 |
| CVE-2025-53357 | 5.4 | Jul 30 | GLPI permits reservation modification by unauthorized users Affected: >= 0.78, < 10.0.19 |