Threat database

GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fixed in version 11.0.7.

An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi: before 11.0.7.

CVE-2026-32312 is a medium severity vulnerability in glpi-project's GLPI software versions 11.0.0 through 11.0.6. It allows an authenticated user with forms READ permission to export the structure of forms they are not authorized to access. This missing authorization issue is identified as CWE-862. The vulnerability has been fixed in version 11.0.7.

GLPI versions from 10.0.0 up to but not including 10.0.24, and from 11.0.0-alpha up to but not including 11.0.6, contain a SQL injection vulnerability in the logs export feature that can be exploited by an authenticated user. This vulnerability allows improper neutralization of special elements in SQL commands, potentially leading to high impact on confidentiality, integrity, and availability.

GLPI versions from 11.0.0 up to but not including 11.0.6 contain an unauthenticated time-based blind SQL injection vulnerability in the Search engine. This vulnerability allows an attacker to execute arbitrary SQL commands without authentication. The issue is fixed in version 11.0.6. The vulnerability has a high severity with a CVSS score of 8.

GLPI versions from 11.0.0 up to but not including 11.0.6 contain a high-severity cross-site scripting (XSS) vulnerability. This flaw allows an unauthenticated user to store malicious scripts through the inventory endpoint. The vulnerability is addressed in version 11.0.6. The CVSS score is 7.

CVE-2026-26026 is a critical vulnerability in the GLPI IT management software versions 11.0.0 up to but not including 11.0.6. It involves improper control of code generation (CWE-94) allowing an administrator to perform template injection that leads to remote code execution (RCE). This vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. The issue is fixed in version 11.0.

GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.

CVE-2026-26001 is a high-severity SQL injection vulnerability in the GLPI Inventory Plugin versions prior to 1.6.6. It arises from improper sanitization of user input in report generation functionality, allowing attackers with adequate privileges to inject malicious SQL commands. Exploitation requires network access and privileges but no user interaction, potentially leading to unauthorized data disclosure and partial data integrity compromise. The vulnerability does not impact availability and has no known exploits in the wild as of now. The issue is fixed in version 1.6.6 of the plugin. Organizations using affected versions should prioritize upgrading to mitigate risk.

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.

CVE-2026-25936 is a medium severity SQL injection vulnerability affecting GLPI versions from 11.0.0 up to but not including 11.0.6. An authenticated user can exploit this flaw to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability does not require user interaction beyond authentication and has no known exploits in the wild as of now. It impacts confidentiality by potentially exposing sensitive data but does not affect integrity or availability. The issue is resolved in version 11.0.

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6.

GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23.

GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .

CVE-2026-22247 is a Server-Side Request Forgery (SSRF) vulnerability affecting GLPI versions 11.0.0 through 11.0.4. An authenticated GLPI administrator can exploit the Webhook feature to make SSRF requests, potentially causing the server to send unauthorized requests to internal or external systems. This vulnerability does not allow direct data modification or denial of service but can lead to information disclosure within the internal network. The issue was patched in version 11.0.5.

GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 11.0.3.

GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.

CVE-2023-53943 is a username enumeration vulnerability in GLPI version 9.5.7's lost password recovery mechanism. Attackers can submit password reset requests with different email addresses and observe response discrepancies to confirm valid user accounts. This vulnerability does not require authentication or user interaction and can be exploited remotely over the network. The CVSS 4.0 score is 6.9 (medium severity), reflecting the ease of exploitation and limited impact on confidentiality, integrity, and availability. While it does not directly allow account takeover, enumerating valid users can facilitate targeted phishing, social engineering, or brute force attacks. European organizations using GLPI 9.

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.