Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
Glpi-projectGlpi

25 matches found

CVE
CVE•added 2022/09/19 4:15 p.m.•1012 views

CVE-2022-35914

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

9.8CVSS9.6AI score0.94395EPSS
In wildWeb
CVE
CVE•added 2024/12/12 2:6 a.m.•887 views

CVE-2024-50339

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

9.3CVSS6.6AI score0.00195EPSS
CVE
CVE•added 2025/03/18 7:15 p.m.•166 views

CVE-2025-24799

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.

9.8CVSS7.9AI score0.65099EPSS
In wildWeb
CVE
CVE•added 2020/05/12 8:15 p.m.•133 views

CVE-2020-11060

In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account havin...

9CVSS7.9AI score0.06283EPSS
Web
CVE
CVE•added 2022/06/28 6:15 p.m.•106 views

CVE-2022-31061

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. U...

9.8CVSS9.7AI score0.43952EPSS
Web
CVE
CVE•added 2020/05/05 10:15 p.m.•89 views

CVE-2020-11035

In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.

9.3CVSS8.2AI score0.00244EPSS
CVE
CVE•added 2022/03/28 2:15 a.m.•75 views

CVE-2021-44617

A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated.

9.8CVSS9.9AI score0.00512EPSS
Web
CVE
CVE•added 2022/11/03 3:15 p.m.•72 views

CVE-2022-39323

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST user_token. This issue has been patched, please upg...

9.8CVSS9AI score0.01434EPSS
CVE
CVE•added 2023/12/13 7:15 p.m.•69 views

CVE-2023-46727

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory.

9.8CVSS9.6AI score0.23296EPSS
CVE
CVE•added 2020/10/07 7:15 p.m.•67 views

CVE-2020-15175

In GLPI before version 9.5.2, the ​pluginimage.send.php​ endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. ...

9.1CVSS7.9AI score0.09825EPSS
CVE
CVE•added 2023/07/13 11:15 p.m.•66 views

CVE-2023-37278

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in version 10.0.9.

9.1CVSS8.3AI score0.00221EPSS
CVE
CVE•added 2023/09/27 3:19 p.m.•64 views

CVE-2023-42462

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version 10...

9.1CVSS8.5AI score0.00592EPSS
CVE
CVE•added 2024/03/18 5:15 p.m.•63 views

CVE-2024-27098

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.

9.6CVSS6.5AI score0.00223EPSS
CVE
CVE•added 2022/06/28 6:15 p.m.•62 views

CVE-2022-31056

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and...

9.8CVSS9.6AI score0.02444EPSS
Web
CVE
CVE•added 2023/04/05 6:15 p.m.•62 views

CVE-2023-28838

GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server. Vers...

9.6CVSS8.7AI score0.00375EPSS
CVE
CVE•added 2025/03/18 7:15 p.m.•61 views

CVE-2025-21619

GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18.

9.8CVSS7.3AI score0.00069EPSS
CVE
CVE•added 2017/07/28 5:29 a.m.•54 views

CVE-2017-11184

SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter.

9.8CVSS9.8AI score0.00266EPSS
Web
CVE
CVE•added 2023/07/05 9:15 p.m.•52 views

CVE-2023-36808

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native i...

9.8CVSS9.6AI score0.1906EPSS
CVE
CVE•added 2017/07/17 1:18 p.m.•51 views

CVE-2017-11329

GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.

9.8CVSS9.8AI score0.00288EPSS
Web
CVE
CVE•added 2023/09/27 3:19 p.m.•51 views

CVE-2023-41320

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences management can be hijacked to lead to SQL injection. This injection can be use to take...

9.8CVSS9.4AI score0.00891EPSS
CVE
CVE•added 2023/09/27 3:19 p.m.•51 views

CVE-2023-42461

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perform a SQL injection. Users are advised t...

9.8CVSS8.4AI score0.00986EPSS
CVE
CVE•added 2023/07/05 8:15 p.m.•46 views

CVE-2023-35924

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.8 has a patch for this issue. As a worka...

9.8CVSS9.6AI score0.13541EPSS
CVE
CVE•added 2017/07/20 4:29 a.m.•43 views

CVE-2017-11474

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php.

9.8CVSS9.8AI score0.0025EPSS
Web
CVE
CVE•added 2015/10/05 2:59 p.m.•42 views

CVE-2015-7684

Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket, then accessing it via a direct request to the file in files/_tmp/.

9CVSS7.6AI score0.01223EPSS
CVE
CVE•added 2023/12/13 7:15 p.m.•34 views

CVE-2023-46726

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11 contains a patch for the issue.

9.8CVSS8.8AI score0.00126EPSS