Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 229

Export CSV
CVE-2024-48912

GLPI vulnerable to authenticated insecure account deletion

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-50339

GLPI vulnerable to unauthenticated session hijacking

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

CVSS 4.0 · 9.3 Critical EPSS 18.7% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-43416

GLPI vulnerable to enumeration of users' email addresses by unauthenticated user

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-37149

GLPI allows remote code execution through the plugin loader

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16.

CVSS 3.1 · 7.2 High EPSS 21.1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-37148

GLPI allows account takeover via SQL Injection in AJAX scripts

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrade to 10.0.16.

CVSS 3.1 · 8.1 High EPSS 20.2% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-37147

GLPI allows Authenticated File Upload to Restricted Tickets

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-31456

GLPI contains an authenticated SQL injection

GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15.

CVSS 3.1 · 7.7 High EPSS 59.1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-27937

glpi Users emails enumeration

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

CVSS 3.1 · 6.5 Medium EPSS 27.1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-27930

Sensitive fields access through dropdowns in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-27098

Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.

CVSS 3.1 · 6.4 Medium EPSS 35.7% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-27104

Stored XSS in dashboards in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-27914

Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2023-34254

Remote inventory task command injection when using ssh command mode

The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. In the case, the agent is running with administration privileges, a malicious user could gain high privileges on the computer glpi-agent is running on. A malicious user could also disclose all remote accesses the agent is configured with for remoteinventory task. This vulnerability has been patched in glpi-agent 1.5.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi Agent
CVE-2024-23645

GLPI reflected XSS in reports pages

GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2023-51446

GLPI LDAP Injection during authentication

GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2023-46727

GLPI SQL injection through inventory agent request

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory.

CVSS 3.1 · 8.6 High EPSS 67.7% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2023-46726

GLPI Remote code execution from LDAP server configuration form on PHP 7.4

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11 contains a patch for the issue.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2023-43813

glpi Authenticated SQL Injection

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue.

CVSS 3.1 · 6.5 Medium EPSS 30.9% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2023-42802

GLPI vulnerable to unallowed PHP script execution

GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server.

CVSS 3.1 · 10 Critical EPSS 1.1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2023-42462

File deletion through document upload process in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

CVSS 3.1 · 7.7 High EPSS 1.3% KEV · Not listed
Vendors
Glpi-project
Products
Glpi