CVE-2026-40108

GLPI Vulnerable to Stored XSS in ITIL Costs

GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fixed in version 11.0.7.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-13490

glpi-project glpi Document document.send.php canViewFile authorization

A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2022-39181

GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS)

GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS). Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or emailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the victim, the content is executed by the victim's browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Reports

CVE-2022-36112

Blind Server-Side Request Forgery (SSRF) in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests can be used to scan server port or services opened on GLPI server or its private network. Queries responses are not exposed to end-user (blind SSRF). Users are advised to upgrade to version 10.0.3 to resolve this issue. There are no known workarounds.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-42317

GLPI vulnerable to arbitrary files deletion by technician

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-42321

GLPI has stored XSS in asset locks

GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-44281

GLPI vulnerable to unauthorized reading of a specific asset object

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object. Upgrade to 11.0.7 or 10.0.25 to receive a patch.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-42320

GLPI vulnerable to arbitrary file access

GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside the GLPI_DOC_DIR. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-5385

GLPI 11.0.0 - Stored XSS in knowledge base

An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi: before 11.0.7.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-32312

GLPI: Unauthorized export of form structure

GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-22247

GLPI is Vulnerable to SSRF via Webhooks

GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-23624

GLPI is vulnerable to session stealing on externally authenticated user change

GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-22044

GLPI is Vulnerable to Authenticated SQL Injection

GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-22821

mreporting affected by a SQLI on date change

mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project Pluginsglpi

Products

More Reporting Mreporting

CVE-2026-25590

GLPI Inventory Plugin has Reflected XSS in task jobs

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi Inventory

CVE-2025-32786

GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1.

CVSS 3.1 · 7.5 High EPSS 7.0% KEV · Not listed

Vendors

Glpi-project

Products

Glpi Inventory

CVE-2025-53360

pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. In versions prior to 1.0.3, any authenticated user could send requests to agents. This issue has been patched in version 1.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Database Inventory

CVE-2025-53105

GLPI permits unauthorized rules execution order

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 10.0.0 to before 10.0.19, a connected user without administration rights can change the rules execution order. This issue has been patched in version 10.0.19.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-25932

GLPI has Stored XSS in Supplier 'Website' field

GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi

CVE-2026-26026

GLPI has a Server-Side Template Injection via Double-Compilation

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.

CVSS 3.1 · 9.1 Critical EPSS 12.0% KEV · Not listed

Vendors

Glpi-project

Products

Glpi