GLPi-project GLPI any version

GLPI vulnerable to Privilege Escalation from Technician to Super-Admin

GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title.

Account takeover through API in GLPI

Privilege Escalation from technician to super-admin in GLPI

Bypassable CSRF protection

Authenticated SQL injection in ticket form

GLPI has an Authenticated SQL Injection

GLPI vulnerable to account takeover via API

GLPI vulnerable to account takeover without privilege escalation through the API

GLPI has an Authenticated SQL Injection via log exports

user session persists even after permanently deleting account in GLPI

GLPI is Vulnerable to Authenticated SQL Injection

SQL injection in GLPI

GLPI contains an SQL injection through the saved searches

GLPI allows account takeover via SQL Injection in AJAX scripts

Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.

GLPI LDAP Injection during authentication

GLPI vulnerable to account takeover by authenticated user

GLPI vulnerable to unauthorized access to Dashboard data

GLPI vulnerable to authenticated insecure account deletion

Unauthenticated Stored XSS in GLPI

LDAP password exposure in glpi

Insecure encryption algorithm in GLPI

GLPI contains an authenticated SQL injection

SQL Injection in through the search engine

Horizontal Privilege Escalation

Any GLPI CalDAV calendars is read-only for every authenticated user

XSS in GLPI

Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.

Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign parameter to ajax/ticketassigninformation.php, (2) filename parameter to front/document.form.php, or (3) table parameter to ajax/comments.php.

Unsafe Reflection in getItemForItemtype()

The FusionInventory plugin before 1.4 for GLPI 9.3.x and before 1.1 for GLPI 9.4.x mishandles sendXML actions.

A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via front/fileupload.php. This feature is protected using different types of security features like the check on the file's extension. However, the application uploads and creates a file, though this file is not allowed, and then deletes the file in the uploadFiles method in inc/glpiuploaderhandler.class.php.

GLPI vulnerable to enumeration of users' email addresses by unauthenticated user

glpi Unauthorized access to inventory files

GLPI vulnerable to unauthenticated access to Dashboard data

GLPI vulnerable to account takeover via the password reset feature

Stored Cross-Site Scripting (XSS) through asset inventory in GLPI

GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin

GLPI allows API document download without rights