Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-25936

GLPI Vulnerable to Authenticated SQL Injection

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project Teclib-edition
Products
Glpi Glpi
CVE-2026-25937

GLPI has a MFA bypass

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project Teclib-edition
Products
Glpi Glpi
CVE-2026-22248

GLPI affected by Remote Code Execution via malicious upload

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Glpi-project Teclib-edition
Products
Glpi Glpi