3432 matches found
PT-2026-99067
Name of the Vulnerable Software and Affected Versions GLPI versions 0.70 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description An authenticated hotliner or technician can bypass the configured default LDAP filter by submitting crafted criteria through the user import feature. This allow...
PT-2026-99071
Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.5 through 11.0.7 Description Permission logic in the software may grant access to a document without confirming if the document is linked to the targeted item. This allows a user to view a document linked to an inaccessible...
PT-2026-99076
Name of the Vulnerable Software and Affected Versions GLPI versions 0.85 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected...
CVE-2026-53625: Missing Authorization
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...
PT-2026-99068
Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description The time-based one-time password TOTP verification endpoint does not limit failed submissions per user. An attacker with a user's primary authentication credentials can repeatedly submit TOTP...
PT-2026-99072
Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description An issue exists where a low-privileged authenticated user can utilize the API v2 to execute update operations that are typically restricted within the user interface. This occurs because the API...
CVE-2026-53610: Improper Neutralization of Input During Web Page Generation
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. Th...
PT-2026-99066
Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description A form administrator can utilize the Form import feature with a specially crafted illustration or scene identifier to perform a directory traversal attack, allowing files to be written outside th...
PT-2026-99069
Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description An attacker can craft a URL for a dashboard that reflects attacker-controlled markup due to insufficient output encoding. A user who opens this crafted URL triggers reflected cross-site scripting...
PT-2026-99075
Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.6 through 11.0.7 Description An authenticated technician can store active markup in supplier website fields. This leads to stored cross-site scripting XSS, where any user viewing the affected item's suppliers list triggers t...
ROS-20260915-73-0202
The vulnerability of the software deployment plugin and the GLPI Inventory network is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries in the database...
Exploit for CVE-2026-61797
CVE-2026-61797 — GLPI PDF Plugin Time-Based Blind SQL Injectio...
Exploit for SQL Injection in Glpi-Project Glpi
CVE-2025-24799 - GLPI SQL Injection Exploit Exploit para vuln...
com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=1.2.1, <=1.2.2), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=3.0.1, <=3.1.1) +4 more potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (3.0.2)
org.graylog2:graylog2-server MAVEN version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count =1.2.1, =3.0.1, =1.0.0, =1.2.0, =1.3...
com.airbus-cyber-security.graylog:graylog-plugin-glpi (1.4.0), org.graylog.plugins:graylog-plugin-parent (3.2.2) +1 more potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (3.2.2)
org.graylog2:graylog2-server MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.graylog2:graylog2-server and may be impacted: - com.airbus-cyber-security.graylog:graylog-plugin-glpi 1.4.0 - org.graylog.plugins:graylog-plugin-parent...
com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=1.1.0, <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=1.0.0, <=6.3.0) +12 more potentially affected by CVE-2026-55841 via org.graylog2:graylog2-server (>=1.0.0-beta.3, <=6.3.11)
org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.1.0, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =2.2.0-alpha.1, =1.1.0, =2.2.0-beta.1, =2.2.0-alpha.1, =1.0.3, =1.0.0-beta.2, =1.2.0-rc.1, =1.3.4 Source cves: CVE-2026-55841 Source advisory: MEND:CVE-2026-55841...
Exploit for Injection in Glpi-Project Glpi
Да. Ниже именно сырой Markdown-текст — копируй содержимое блока...
Exploit for Injection in Glpi-Project Glpi
CVE-2022-35914 by cyb3rk0ala PoC for CVE-2022-35914, a co...