CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-24801 – GLPI allows authenticated remote code execution
https://notcve.org/view.php?id=CVE-2025-24801
18 Mar 2025 — GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18. • https://github.com/glpi-project/glpi/security/advisories/GHSA-g2p3-33ff-r555 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-21619 – GLPI allows SQL injection through the rules configuration
https://notcve.org/view.php?id=CVE-2025-21619
18 Mar 2025 — GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18. • https://github.com/glpi-project/glpi/security/advisories/GHSA-pcmc-xv3g-hjxv • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-25192 – GLPI allows unauthorized access to debug mode
https://notcve.org/view.php?id=CVE-2025-25192
25 Feb 2025 — GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file. • https://github.com/glpi-project/glpi/releases/tag/10.0.18 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-23024 – GLPI: Plugins are disabled accessing one page
https://notcve.org/view.php?id=CVE-2025-23024
25 Feb 2025 — GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file. • https://github.com/glpi-project/glpi/releases/tag/10.0.18 • CWE-285: Improper Authorization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-21627 – GLPI Cross-site Scripting vulnerability
https://notcve.org/view.php?id=CVE-2025-21627
25 Feb 2025 — GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue. • https://github.com/glpi-project/glpi/security/advisories/GHSA-qm8p-jmj2-qfc2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-21626 – GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint
https://notcve.org/view.php?id=CVE-2025-21626
25 Feb 2025 — GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the `status.php` endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the `status.php` file, restrict its access, or remove any sensitive values from the `name` field of the active LDAP directories, mail servers authentication providers and mail receivers. • https://github.com/glpi-project/glpi/releases/tag/10.0.18 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47761 – GLPI vulnerable to account takeover via the password reset feature
https://notcve.org/view.php?id=CVE-2024-47761
11 Dec 2024 — GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.17 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47760 – GLPI vulnerable to account takeover via API
https://notcve.org/view.php?id=CVE-2024-47760
11 Dec 2024 — GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.17 • CWE-284: Improper Access Control •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47758 – GLPI vulnerable to account takeover without privilege escalation through the API
https://notcve.org/view.php?id=CVE-2024-47758
11 Dec 2024 — GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.17 • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 2%CPEs: 1EXPL: 1CVE-2024-43416 – GLPI vulnerable to enumeration of users' email addresses by unauthenticated user
https://notcve.org/view.php?id=CVE-2024-43416
18 Nov 2024 — GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue. • https://github.com/0xmupa/CVE-2024-43416-PoC • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •