CVE-2026-40108 GLPI Vulnerable to Stored XSS in ITIL Costs

GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fixed in version 11.0.7...

The vulnerability of the plugin for the GLPI system, Mreporting, relates to the lack of security measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the Mreporting plugin for the GLPI system is related to the lack of security measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management processes, related to the failure to protect the SQL request structure, allows attackers to execute arbitrary code.

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management processes is related to the lack of measures taken to protect the SQL request structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management processes, related to the failure to protect the SQL request structure, allows attackers to execute arbitrary code.

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management processes is related to the lack of measures taken to protect the SQL request structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

The vulnerability of the GLPI system’s request, incident, and asset inventory management, related to improper session management, allows a perpetrator to intercept the user’s session.

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to improper session management. Exploiting this vulnerability can allow a malicious actor to intercept a user’s session...

The vulnerability of the GLPI system’s request, incident, and asset inventory management processes, related to the lack of measures taken to protect the website structure, allows a perpetrator to execute arbitrary codes.

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary codes remotely...

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment is related to lack of access control, which allows an intruder to increase their privileges.

The vulnerability of the GLPI system’s request, incident, and asset inventory management processes, related to insufficient access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to deficiencies in the authorization process, which allows unauthorized users to gain access to protected information.

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment, related to deficiencies in authorization procedures. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-26027 GLPI has an Unauthenticated Stored XSS via inventory

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6...

The vulnerability of the GLPI system’s request, incident, and asset inventory management processes, related to bypassing authentication using a key, allows unauthorized users to gain unauthorized access and modify protected information.

The vulnerability of the GLPI system for requests, incidents, and inventory management involves bypassing authentication using a password. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access and modify protected information...

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment, related to errors in access control, allows a intruder to gain unauthorized access and delete protected information.

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to access control errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access and delete protected information...

The vulnerability of the GLPI system’s request, incident, and inventory management functions lies in the redirection of URLs to an unreliable website when processing the redirect parameter. This allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to the redirection of URLs to an unreliable website during the processing of the redirect parameter. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and...

Linux Distros Unpatched Vulnerability : CVE-2017-11474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computersoftwareversion.class.php, exploitable via ajax/common.tabs.php. CVE-2017-11474 Note...

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment, related to incorrect authentication, allows a perpetrator to bypass the authentication process.

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process...

The vulnerability of the GLPI system’s request, incident, and asset inventory management processes, related to the lack of measures taken to protect the website structure, allows attackers to carry out attacks using cross-site scripting (XSS).

The vulnerability of the GLPI system’s request, incident, and asset inventory management functions is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows attackers who operate remotely to carry out attacks using cross-site scripting XSS...

ROS-20250403-15

Vulnerabilities in GLPI's computer hardware request, incident and inventory system are related to improper access control. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to confidential information...

The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory allows a hacker to inject arbitrary PHP code.

The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory management is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to inject arbitrary PHP code remotely...

ROS-20250121-10

Vulnerability of GLPI system of requests, incidents and inventory of computer equipment is related to Failure to take measures to protect the SQL query structure. Exploitation of the vulnerability could allow an intruder, acting remotely, to disclose protected information...

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management, related to improper access control, allows a intruder to gain unauthorized access to the account.

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to improper access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the user account...

The vulnerability of the GLPI system’s request, incident, and asset inventory management processes, related to the lack of measures taken to protect the website structure, allows a malicious attacker to carry out XSS attacks.

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management systems lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...