[ Vendor · 15 CVEs ]
glpi-project
CVEs affecting glpi-project published in the last 30 days, plus any glpi-project CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108726 | 11 Oct 2026 | CVSS 4.3 | glpi-project GLPIGLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes… | |
| CVE-2026-55214 | 25 Sep 2026 | CVSS 8.5 | glpi-project glpiGLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier… | |
| CVE-2026-55217 | 25 Sep 2026 | CVSS 5.3 | glpi-project glpiGLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update… | |
| CVE-2026-53628 | 25 Sep 2026 | CVSS 5.9 | glpi-project glpiGLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or… | |
| CVE-2026-53629 | 25 Sep 2026 | CVSS 7.1 | glpi-project glpiGLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL… | |
| CVE-2026-53610 | 25 Sep 2026 | CVSS 7.5 | glpi-project glpiGLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects… | |
| CVE-2026-53625 | 25 Sep 2026 | CVSS 7.5 | glpi-project glpiGLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through… | |
| CVE-2026-53626 | 25 Sep 2026 | CVSS 7.1 | glpi-project glpiGLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a… | |
| CVE-2026-53627 | 25 Sep 2026 | CVSS 6.0 | glpi-project glpiGLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to… | |
| CVE-2026-49469 | 25 Sep 2026 | CVSS 4.6 | glpi-project glpiGLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit… | |
| CVE-2026-49470 | 25 Sep 2026 | CVSS 7.7 | glpi-project glpiGLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not… | |
| CVE-2026-48482 | 25 Sep 2026 | CVSS 9.4 | glpi-project glpiGLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted… | |
| CVE-2026-47679 | 25 Sep 2026 | CVSS 8.5 | glpi-project glpiGLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path… | |
| CVE-2026-45801 | 25 Sep 2026 | CVSS 5.3 | glpi-project glpiGLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission… | |
| CVE-2022-35914 | 19 Sep 2022 | CVSS 9.8 | Teclib GLPI Remote Code Execution/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. | ExploitedFix |