pluginsGLPI vulnerabilities
We track 4 vulnerabilities in pluginsGLPI products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on March 16, 2026.
Latest pluginsGLPI vulnerabilities
- 9.1 Critical severity
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms.
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.
- 8.2 High severity
addressing: Use of Externally-Controlled Input to Select Classes or Code
The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network.. Starting with 3.0.0 and before 3.0.3, a poor security check allows an unauthenticated attacker to determine whether data exists (by name)
- 7.7 High severity
fields: Improper Neutralization of Special Elements used in an SQL Command
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13.
- 8.8 High severity
order: Deserialization of Untrusted Data
The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system com