CVE-2019-12530

Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=1.1.0, <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=1.0.0, <=6.0.0) +12 more potentially affected by CVE-2025-46827 via org.graylog2:graylog2-server (>=1.0.0-beta.3, <=6.0.13)

org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.1.0, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =2.2.0-alpha.1, =1.1.0, =2.2.0-beta.1, =2.2.0-alpha.1, =1.0.3, =1.0.0-beta.2, =1.2.0-rc.1, =1.3.4 Source cves: CVE-2025-46827 Source advisory: MEND:CVE-2025-46827...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=1.2.1, <=1.2.2), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=3.0.1, <=3.1.1) +4 more potentially affected by unknown CVE via org.graylog2:graylog2-server (3.0.2)

org.graylog2:graylog2-server MAVEN version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count =1.2.1, =3.0.1, =1.0.0, =1.2.0, =1.3...

Exploit for Unrestricted Upload of File with Dangerous Type in Glpi-Project Glpi

CVE-2025-24801 PoC for GLPI RCE This repository contains a pr...

CVE-2022-39181

GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting RXSS. Type 1: Reflected XSS or Non-Persistent - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content t...

Exploit for Unrestricted Upload of File with Dangerous Type in Glpi-Project Glpi

CVE-2025-24801 This exploit uses CVE-2025-24801 to get Remote...

VulnCheck KEV: CVE-2025-24799

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18...

Exploit for SQL Injection in Glpi-Project Glpi

Exploit-CVE-2025-24799 CVE-2025-24799 Exploit: GLPI - Unauthen...

GLPI Unauthorized Access

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to insufficient protection of operational data. Exploiting this vulnerability can allow unauthorized actors to gain unauthorized access to protected information...

GLPI XSS

The vulnerability of the GLPI system’s request, incident, and asset inventory management functions is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows attackers who operate remotely to carry out attacks using cross-site scripting XSS...

GLPI Authentication Bypass

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process...

ROS-20250403-15

Vulnerabilities in GLPI's computer hardware request, incident and inventory system are related to improper access control. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to confidential information...

ROS-20250402-04

Vulnerability of the GLPI system of requests, incidents and inventory of computer equipment is related to improperly restricting access to the "install/update.php" file. Exploitation of the vulnerability could allow An attacker acting remotely could gain access to confidential information A...

Metasploit Wrap-Up 03/28/2025

Windows LPE - Cloud File Mini Filer Driver Heap Overflow This Metasploit release includes an exploit module for CVE-2024-30085, an LPE in cldflt.sys which is known as the Windows Cloud Files Mini Filer Driver. This driver allows users to manage and sync files between a remote server and a local...

CVE-2025-27147

The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory SNMP, software deployment, VMWare ESX host remote inventory, and data collection files, Windows registry, WMI. Versions prior to 1.5.0 have an improper access control vulnerability...

htmlawed module GLPI Arbitrary PHP Injection

The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory management is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to inject arbitrary PHP code remotely...

CVE-2025-27147

The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory SNMP, software deployment, VMWare ESX host remote inventory, and data collection files, Windows registry, WMI. Versions prior to 1.5.0 have an improper access control vulnerability...

CVE-2025-27147

The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory SNMP, software deployment, VMWare ESX host remote inventory, and data collection files, Windows registry, WMI. Versions prior to 1.5.0 have an improper access control vulnerability...

CVE-2025-27147

The CVE-2025-27147 issue affects the GLPI Inventory Plugin used with GLPI, where versions prior to 1.5.0 contain an improper access control vulnerability. Reported details across connected sources consistently point to an access-control weakness in GLPI Inventory Plugin tasks (network discovery, ...

CVE-2025-27147 GLPI Inventory plugin has Improper Access Control Vulnerability

The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory SNMP, software deployment, VMWare ESX host remote inventory, and data collection files, Windows registry, WMI. Versions prior to 1.5.0 have an improper access control vulnerability...