Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
255 results · page 2 of 6
Jul 30, 2025GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, liCVE-2025-53357 · Other software · glpi-project · reported by GitHubMedium 5.4
GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.78 through 10.0.18, a connected user can alter the reservations of another user. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, liCVE-2025-53113 · Other software · glpi-project · reported by GitHubLow 2.7
GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do not have the right to see. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2025-53112 · Other software · glpi-project · reported by GitHubMedium 4.3
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025GLPI is a Free Asset and IT Management Software package.CVE-2025-53111 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to some resources. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tCVE-2025-53008 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver credentials. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025GLPI is a Free Asset and IT Management Software package.CVE-2025-52897 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2025-52567 · Other software · glpi-project · reported by GitHubLow 3.5
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. The previous security patches provided since GLPI 10.0.4 were not robust enough for certain specific cases. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2025-27514 · Other software · glpi-project · reported by GitHubMedium 4.5
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025Escalade GLPI plugin is a ticket escalation process helper for GLPI.CVE-2025-27153 · Other software · pluginsGLPI · reported by GitHubMedium 6.5
Escalade GLPI plugin is a ticket escalation process helper for GLPI. Prior to version 2.9.11, there is an improper access control vulnerability. This can lead to data exposure and workflow disruptions. This issue has been patched in version 2.9.11.
- Product
- escalade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX hostCVE-2025-27147 · Other software · glpi-project · reported by GitHubHigh 8.2
The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access control vulnerability. Version 1.5.0 fixes the vulnerability.
- Product
- glpi-inventory-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025GLPI is a free asset and IT management software package.CVE-2025-24801 · Other software · glpi-project · reported by GitHubHigh 8.5
GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025GLPI is a free asset and IT management software package.CVE-2025-24799 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025GLPI is a free asset and IT management software package.CVE-2025-21619 · Other software · glpi-project · reported by GitHubHigh 8.2
GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package.CVE-2025-26626 · Other software · glpi-project · reported by GitHubMedium 6.5
The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vulnerable to reflective cross-site scripting, which may lead to executing javascript code. Version 1.5.0 fixes the issue.
- Product
- glpi-inventory-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025GLPI is a free asset and IT management software package.CVE-2025-25192 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025GLPI is a free asset and IT management software package.CVE-2025-23046 · Other software · glpi-project · reported by GitHubMedium 6.3
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025GLPI is a free asset and IT management software package.CVE-2025-23024 · Other software · glpi-project · reported by GitHubMedium 6.9
GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025GLPI is a free asset and IT management software package.CVE-2025-21627 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025GLPI is a free asset and IT management software package.CVE-2025-21626 · Other software · glpi-project · reported by GitHubMedium 5.8
GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the `status.php` endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the `status.php` file, restrict its access, or remove any sensitive values from the `name` field of the active LDAP directories, mail servers authentication providers and mail receivers.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025A vulnerability was found in GLPI up to 10.0.17.CVE-2024-11955 · Other software · Glpi-project · reported by VulDBMedium 5.3
A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument redirect leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.0.18 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2024Tasklists provides plugin tasklists for GLPI.CVE-2024-56801 · Other software · InfotelGLPI · reported by GitHubMedium 6.9
Tasklists provides plugin tasklists for GLPI. Versions prior to 2.0.4 have a blind SQL injection vulnerability. Version 2.0.4 contains a patch for the vulnerability.
- Product
- tasklists
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network..CVE-2024-53850 · Other software · pluginsGLPI · reported by GitHubHigh 8.2
The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network.. Starting with 3.0.0 and before 3.0.3, a poor security check allows an unauthenticated attacker to determine whether data exists (by name) in GLPI.
- Product
- addressing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms.CVE-2024-45600 · Other software · pluginsGLPI · reported by GitHubHigh 7.7
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13.
- Product
- fields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-50339 · Other software · glpi-project · reported by GitHubCritical 9.3
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-48912 · Other software · glpi-project · reported by GitHubHigh 7.2
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-47761 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-47760 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024GLPI is a free asset and IT management software package.CVE-2024-47758 · Other software · glpi-project · reported by GitHubHigh 7.6
GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024GLPI is a free asset and IT management software package.CVE-2024-43416 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-38370 · Other software · glpi-project · reported by GitHubMedium 5.3
GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appropriate rights. Upgrade to 10.0.16.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2024-45611 · Other software · glpi-project · reported by GitHubMedium 5.7
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload to triggger a stored XSS. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2024-45610 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Cable form. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-45609 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the reports pages. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-45608 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-43418 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-43417 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Software form. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-41679 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free Asset and IT management software package.CVE-2024-47759 · Other software · glpi-project · reported by GitHubMedium 6.7
GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then be executed when any user will try to see the document contents. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-41678 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024GLPI is a free asset and IT management software package.CVE-2024-40638 · Other software · glpi-project · reported by GitHubHigh 8.1
GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2024-37149 · Other software · glpi-project · reported by GitHubHigh 7.2
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2024-37148 · Other software · glpi-project · reported by GitHubHigh 8.1
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrade to 10.0.16.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2024-37147 · Other software · glpi-project · reported by GitHubMedium 4.3
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024GLPI is a Free Asset and IT Management Software package.CVE-2024-31456 · Other software · glpi-project · reported by GitHubHigh 7.7
GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024GLPI is a Free Asset and IT Management Software package.CVE-2024-29889 · Other software · glpi-project · reported by GitHubHigh 7.1
GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input.CVE-2024-31705 · Other software · glpi-project · reported by MITRECritical 9.8
An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Apr 25, 2024The GLPI Agent is a generic management agent.CVE-2024-28241 · Other software · glpi-project · reported by GitHubHigh 7.3
The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which involves installed folder is automatically secured by the system.
- Product
- glpi-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024The GLPI Agent is a generic management agent.CVE-2024-28240 · Other software · glpi-project · reported by GitHubHigh 7.3
The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy task is installed, a local malicious user can trigger privilege escalation configuring a malicious server providing its own deploy task payload. GLPI-Agent 1.7.2 contains a patch for this issue. As a workaround, edit GLPI-Agent related key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` and add `SystemComponent` DWORD value setting it to `1` to hide GLPI-Agent from installed applications.
- Product
- glpi-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-27914 · Other software · glpi-project · reported by GitHubMedium 5.3
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2024GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-27104 · Other software · glpi-project · reported by GitHubMedium 4.5
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.