Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 228

Export CSV
CVE-2024-41678

GLPI has multiple reflected XSS

GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-41679

Authenticated SQL injection in ticket form

GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-43417

Reflected XSS in Software form

GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Software form. Upgrade to 10.0.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-43418

GLPI has multiple reflected XSS

GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-45608

GLPI has an Authenticated SQL Injection

GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-45609

GLPI has a Reflected XSS in /front/stat.graph.php

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the reports pages. Upgrade to 10.0.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-45610

GLPI has a reflected XSS in ajax/cable.php

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Cable form. Upgrade to 10.0.17.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-45611

GLPI has a stored XSS at src/RSSFeed.php

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload to triggger a stored XSS. Upgrade to 10.0.17.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi