GLPI Project vulnerabilities
We track 79 vulnerabilities in GLPI Project products across 4 products. 79 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 4, 2026.
Latest GLPI Project vulnerabilities
- 8.8 High severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17.
- 8.8 High severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.
- 8.8 High severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.
- 8.8 High severity
glpi: Improper Control of Generation of Code
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this m
- 8.1 High severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user accoun
- 8.1 High severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements used in an OS Command
An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input.
- 7.8 High severity
glpi-agent: Improper Privilege Management
The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use
- 7.8 High severity
The GLPI Agent is a generic management agent.
The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Ad
- 9.6 Critical severity
glpi: Server-Side Request Forgery
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched
- 8.1 High severity
glpi: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable nati
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11
- 8.8 High severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue.
- 9.8 Critical severity
glpi: Unrestricted Upload of File with Dangerous Type
GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and ava
- 9.1 Critical severity
glpi: Unrestricted Upload of File with Dangerous Type
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Use
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perfo
- 8.8 High severity
glpi: Improper Privilege Management
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter
- 8.8 High severity
glpi: Improper Privilege Management
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal account
- 8.8 High severity
glpi: Improper Privilege Management
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences management can be hijacked to lead to SQL injec
- 9.1 Critical severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in versio
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As
- 7.5 High severity
glpi: Missing Authorization
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains a patch for this is
- 8.1 High severity
glpi: Improper Access Control
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user (or not for certain actions), allows a threat actor to interact, modify
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.8
- 7.2 High severity
glpi-agent: Improper Neutralization of Special Elements used in an OS Command
The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent wou
- 8.1 High severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some case
- 8.8 High severity
glpi: Improper Authorization
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negot
- 8.1 High severity
glpi: Improper Privilege Management
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" fea
- 7.5 High severity
glpi: Incorrect Authorization
GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, invento
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST user_token.
- 8.8 High severity
GLPI stands for Gestionnaire Libre de Parc Informatique.
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as
- 9.8 Critical severity
Teclib GLPI Remote Code Execution Exploited
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injec
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are re
- 9.8 Critical severity
glpi: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue
- 9.8 Critical severity
glpi-inventory-plugin: Improper Neutralization of Special Elements used in an SQL Command
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be
- 7.5 High severity
glpi: Insufficiently Protected Credentials
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and wh