CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-24801 – GLPI allows authenticated remote code execution
https://notcve.org/view.php?id=CVE-2025-24801
18 Mar 2025 — GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18. • https://github.com/glpi-project/glpi/security/advisories/GHSA-g2p3-33ff-r555 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.8EPSS: 16%CPEs: 1EXPL: 1CVE-2025-24799 – GLPI allows unauthenticated SQL injection through the inventory endpoint
https://notcve.org/view.php?id=CVE-2025-24799
18 Mar 2025 — GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18. • https://github.com/realcodeb0ss/CVE-2025-24799-PoC • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-21619 – GLPI allows SQL injection through the rules configuration
https://notcve.org/view.php?id=CVE-2025-21619
18 Mar 2025 — GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18. • https://github.com/glpi-project/glpi/security/advisories/GHSA-pcmc-xv3g-hjxv • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-25192 – GLPI allows unauthorized access to debug mode
https://notcve.org/view.php?id=CVE-2025-25192
25 Feb 2025 — GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file. • https://github.com/glpi-project/glpi/releases/tag/10.0.18 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-23046 – GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin
https://notcve.org/view.php?id=CVE-2025-23046
25 Feb 2025 — GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP... • https://github.com/glpi-project/glpi/releases/tag/10.0.18 • CWE-303: Incorrect Implementation of Authentication Algorithm •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-23024 – GLPI: Plugins are disabled accessing one page
https://notcve.org/view.php?id=CVE-2025-23024
25 Feb 2025 — GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file. • https://github.com/glpi-project/glpi/releases/tag/10.0.18 • CWE-285: Improper Authorization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-21627 – GLPI Cross-site Scripting vulnerability
https://notcve.org/view.php?id=CVE-2025-21627
25 Feb 2025 — GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue. • https://github.com/glpi-project/glpi/security/advisories/GHSA-qm8p-jmj2-qfc2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-21626 – GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint
https://notcve.org/view.php?id=CVE-2025-21626
25 Feb 2025 — GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the `status.php` endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the `status.php` file, restrict its access, or remove any sensitive values from the `name` field of the active LDAP directories, mail servers authentication providers and mail receivers. • https://github.com/glpi-project/glpi/releases/tag/10.0.18 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50339 – GLPI vulnerable to unauthenticated session hijacking
https://notcve.org/view.php?id=CVE-2024-50339
11 Dec 2024 — GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.17 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48912 – GLPI vulnerable to authenticated insecure account deletion
https://notcve.org/view.php?id=CVE-2024-48912
11 Dec 2024 — GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.17 • CWE-284: Improper Access Control •