Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
255 results · page 1 of 6
Oct 11, 2026GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannoCVE-2026-108726 · Other software · glpi-project · reported by VulnCheckMedium 5.3
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.
- Product
- GLPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-55217 · Other software · glpi-project · reported by GitHubMedium 5.3
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-55214 · Other software · glpi-project · reported by GitHubHigh 8.5
GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53629 · Other software · glpi-project · reported by GitHubHigh 7.1
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53628 · Other software · glpi-project · reported by GitHubMedium 5.9
GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53627 · Other software · glpi-project · reported by GitHubMedium 6
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53626 · Other software · glpi-project · reported by GitHubHigh 7.1
GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53625 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-53610 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-49470 · Other software · glpi-project · reported by GitHubHigh 7.7
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-49469 · Other software · glpi-project · reported by GitHubMedium 4.6
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-48482 · Other software · glpi-project · reported by GitHubCritical 9.4
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-47679 · Other software · glpi-project · reported by GitHubHigh 8.5
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026GLPI is a free asset and IT management software package.CVE-2026-45801 · Other software · glpi-project · reported by GitHubMedium 5.3
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without paramCVE-2026-11321 · Other software · pluginsGLPI · reported by VulnCheckHigh 7.1
The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embed SQL expressions such as SLEEP() in a mapped field (for example Serial Number) to manipulate the generated query and extract database information via time-based blind injection.
- Product
- datainjection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanCoCVE-2026-53987 · Other software · Tag plugin · reported by VulnCheckHigh 7.3
The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.
- Product
- GLPI 11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2026A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7.CVE-2026-13490 · Other software · glpi-project · reported by VulDBMedium 6.3
A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026GLPI is a free asset and IT management software package.CVE-2026-44281 · Other software · glpi-project · reported by GitHubHigh 7
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object. Upgrade to 11.0.7 or 10.0.25 to receive a patch.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026GLPI is a free asset and IT management software package.CVE-2026-42321 · Other software · glpi-project · reported by GitHubHigh 8.4
GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026GLPI is a free asset and IT management software package.CVE-2026-42320 · Other software · glpi-project · reported by GitHubMedium 5.9
GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside the GLPI_DOC_DIR. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026GLPI is a free asset and IT management software package.CVE-2026-42318 · Other software · glpi-project · reported by GitHubHigh 7
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvokecyber.com
Jun 3, 2026GLPI is a free asset and IT management software package.CVE-2026-42317 · Other software · glpi-project · reported by GitHubHigh 7
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026GLPI is a free asset and IT management software package.CVE-2026-40108 · Other software · glpi-project · reported by GitHubHigh 7.1
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fixed in version 11.0.7.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item.CVE-2026-5385 · Other software · glpi-project · reported by help@fluidattacks.comHigh 8.4
An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi: before 11.0.7.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
May 18, 2026GLPI is a free asset and IT management software package.CVE-2026-32312 · Other software · glpi-project · reported by GitHubMedium 5.1
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026GLPI is a free asset and IT management software package.CVE-2026-29047 · Other software · glpi-project · reported by GitHubHigh 7.2
GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026GLPI is a free asset and IT management software package.CVE-2026-26263 · Other software · glpi-project · reported by GitHubHigh 8.1
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026GLPI is a free asset and IT management software package.CVE-2026-26027 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026GLPI is a free asset and IT management software package.CVE-2026-26026 · Other software · glpi-project · reported by GitHubCritical 9.1
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026GLPI is a Free Asset and IT Management Software package.CVE-2026-25932 · Other software · glpi-project · reported by GitHubHigh 7.2
GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents.CVE-2026-26001 · Other software · glpi-project · reported by GitHubHigh 7.1
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.
- Product
- glpi-inventory-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026GLPI is a free Asset and IT management software package.CVE-2026-25937 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026GLPI is a free Asset and IT management software package.CVE-2026-25936 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms.CVE-2026-23489 · Other software · pluginsGLPI · reported by GitHubCritical 9.1
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.
- Product
- fields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2026-22248 · Other software · glpi-project · reported by GitHubHigh 8
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents.CVE-2026-25590 · Other software · glpi-project · reported by GitHubMedium 4.5
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6.
- Product
- glpi-inventory-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026mreporting is the more reporting GLPI plugin.CVE-2026-22821 · Other software · pluginsGLPI · reported by GitHubMedium 4.9
mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4.
- Product
- mreporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026GLPI is a free asset and IT management software package.CVE-2026-23624 · Other software · glpi-project · reported by GitHubMedium 4.3
GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026GLPI is a free asset and IT management software package.CVE-2026-22247 · Other software · glpi-project · reported by GitHubMedium 4.1
GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026GLPI is a free asset and IT management software package.CVE-2026-22044 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026GLPI is a free asset and IT management software package.CVE-2025-66417 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 11.0.3.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026GLPI is a free asset and IT management software package.CVE-2025-64516 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation.CVE-2025-65035 · Other software · pluginsGLPI · reported by GitHubMedium 6.4
pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions (database write access must first be obtained through another vulnerability or misconfiguration), user-controlled data is stored insecurely in the database via computergroup, and is later unserialized on every page load, allowing arbitrary PHP object instantiation. Version 1.1.2 fixes the issue.
- Product
- databaseinventory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses.CVE-2023-53943 · Other software · Glpi-Project · reported by VulnCheckMedium 6.9
GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts.
- Product
- GLPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglpi-project.orgexploit-db.com
Dec 16, 2025GLPI is a free asset and IT management software package.CVE-2025-64520 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025GLPI is a free asset and IT management software package.CVE-2025-59935 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation.CVE-2025-53360 · Other software · pluginsGLPI · reported by GitHubMedium 4.3
pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. In versions prior to 1.0.3, any authenticated user could send requests to agents. This issue has been patched in version 1.0.3.
- Product
- databaseinventory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2025The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents.CVE-2025-32786 · Other software · glpi-project · reported by GitHubHigh 7.5
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1.
- Product
- glpi-inventory-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, liCVE-2025-53105 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 10.0.0 to before 10.0.19, a connected user without administration rights can change the rules execution order. This issue has been patched in version 10.0.19.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI.CVE-2025-54780 · Other software · cconard96 · reported by GitHubHigh 7.7
The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php endpoint to leak files from the system or use PHP wrappers. This is fixed in version 2.0.2.
- Product
- glpi-screenshot-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.