Skip to content
Noroxi

glpi-project records

206 published records for vendor glpi-project.

Researcher profile

Entered KEV
1 · 0.5%
Weaponized
3 · 1.5%
Pre-auth RCE
8
With a fix record
44.7%
Median publish → KEV
169 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

206 records
  • CVE-2022-35914
    99Now

    /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    glpi-project · glpiSep 19, 2022

  • CVE-2025-24799
    65This week

    GLPI allows unauthenticated SQL injection through the inventory endpoint

    CriticalCVSS 9.8WeaponizedEPSS 86%

    glpi-project · glpiMar 18, 2025

  • CVE-2023-46727
    59Plan

    GLPI SQL injection through inventory agent request

    CriticalCVSS 9.8No exploitEPSS 67%

    glpi-project · glpiDec 13, 2023

  • CVE-2020-15175
    57Plan

    Unauthenticated File Deletion in GLPI

    CriticalCVSS 9.1Proof of conceptEPSS 69%

    glpi-project · glpiOct 7, 2020

  • CVE-2023-35924
    55Plan

    GLPI vulnerable to SQL injection via inventory agent request

    CriticalCVSS 9.8No exploitEPSS 52%

    glpi-project · glpiJul 5, 2023

  • CVE-2022-31061
    54Plan

    SQL injection on login page in GLPI

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    glpi-project · glpiJun 28, 2022

  • CVE-2023-36808
    53Plan

    GLPI vulnerable to SQL injection through Computer Virtual Machine information

    CriticalCVSS 9.8Proof of conceptEPSS 47%

    glpi-project · glpiJul 5, 2023

  • CVE-2024-29889
    51Plan

    GLPI contains an SQL injection through the saved searches

    HighCVSS 8.1Proof of conceptEPSS 64%

    glpi-project · glpiMay 7, 2024

  • CVE-2022-39323
    50Plan

    SQL Injection on REST API in GLPI

    CriticalCVSS 9.8No exploitEPSS 37%

    glpi-project · glpiNov 3, 2022

  • CVE-2023-41320
    50Plan

    Account takeover via SQL Injection in UI layout preferences in GLPI

    CriticalCVSS 9.8No exploitEPSS 36%

    glpi-project · glpiSep 27, 2023

  • CVE-2024-27098
    49Plan

    Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI

    CriticalCVSS 9.6No exploitEPSS 35%

    glpi-project · glpiMar 18, 2024

  • CVE-2021-43778
    46Plan

    Path traversal in GLPI barcode plugin

    HighCVSS 7.5Proof of conceptEPSS 51%

    glpi-project · barcodeNov 24, 2021

  • CVE-2024-40638
    46Plan

    GLPI allows account takeover via SQL Injection in AJAX scripts

    HighCVSS 8.8No exploitEPSS 38%

    glpi-project · glpiNov 15, 2024

  • CVE-2023-41326
    46Plan

    Account takeover via Kanban feature in GLPI

    HighCVSS 8.8No exploitEPSS 36%

    glpi-project · glpiSep 27, 2023

  • CVE-2024-31456
    44Plan

    GLPI contains an authenticated SQL injection

    MediumCVSS 6.5No exploitEPSS 59%

    glpi-project · glpiMay 7, 2024

  • CVE-2024-27096
    44Plan

    SQL Injection in through the search engine

    MediumCVSS 6.5No exploitEPSS 58%

    glpi-project · glpiMar 18, 2024

  • CVE-2023-43813
    44Plan

    glpi Authenticated SQL Injection

    HighCVSS 8.8No exploitEPSS 30%

    glpi-project · glpiDec 13, 2023

  • CVE-2024-50339
    43Plan

    GLPI vulnerable to unauthenticated session hijacking

    CriticalCVSS 9.3No exploitEPSS 18%

    glpi-project · glpiDec 11, 2024

  • CVE-2022-31056
    42Plan

    SQL injection with _actor parameter in GLPI

    CriticalCVSS 9.8Proof of conceptEPSS 9%

    glpi-project · glpiJun 28, 2022

  • CVE-2026-26263
    42Plan

    GLPI has an Unauthenticated SQL Injection via Search engine

    CriticalCVSS 9.8No exploitEPSS 8%

    glpi-project · glpiApr 6, 2026

  • CVE-2025-24801
    41Plan

    GLPI allows authenticated remote code execution

    HighCVSS 8.8Proof of conceptEPSS 21%

    glpi-project · glpiMar 18, 2025

  • CVE-2024-37149
    41Plan

    GLPI allows remote code execution through the plugin loader

    HighCVSS 8.8No exploitEPSS 21%

    glpi-project · glpiJul 10, 2024

  • CVE-2022-34128
    41Plan

    The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.

    CriticalCVSS 9.8Proof of conceptEPSS 7%

    glpi-project · positionsApr 15, 2023

  • CVE-2013-5696
    40Plan

    inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, whi

    MediumCVSS 6.8WeaponizedEPSS 7%

    glpi-project · glpiSep 22, 2013

  • CVE-2021-44617
    40Plan

    A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated.

    CriticalCVSS 9.8No exploitEPSS 2%

    glpi-project · glpiMar 27, 2022