GLPi-project GLPI any version

GLPI incorrectly authorizes access to documents

GLPI has an Unauthenticated Stored XSS via inventory

Cross site scripting via SVG file upload in GLPI

Public GLPIKEY can be used to decrypt any data in GLPI

Able to read any token through API user endpoint in GLPI

GLPI has Stored XSS in Supplier 'Website' field

SQL Injection in glpi

GLPI: Plugins are disabled accessing one page

inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.

Insecure Direct Object Reference (IDOR) on "Solutions"

Cross-site request forgery (CSRF) vulnerability in GLPI-PROJECT GLPI before 0.83.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Stored Cross Site Scripting (XSS) through global search in GLPI

XSS injection in ajax/kanban

glpi subject to Cross-site Scripting (XSS) - Reflected

GLPI has a stored XSS via document upload

glpi Users emails enumeration

SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter.

Sensitive fields access through dropdowns in GLPI

Autologin cookie accessible by scripts

GLPI reflected XSS in reports pages

SQL injection through plugin controller in GLPI

Sensitive fields enumeration through API in GLPI

glpi vulnerable to Unauthorized access to data export

GLPI allows unauthorized access to debug mode

GLPI vulnerable to unauthorized access to User data

GLPI vulnerable to unauthorized access to KnowbaseItem data

Improper input validation on emails links in GLPI

GLPI vulnerable to reflected XSS in search pages

GLPI has multiple reflected XSS

GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint

GLPI has multiple reflected XSS

GLPI is vulnerable to session stealing on externally authenticated user change

GLPI Cross-site Scripting vulnerability

Reflected XSS in Software form

GLPI has a Reflected XSS in /front/stat.graph.php

GLPI has a reflected XSS in ajax/cable.php

GLPI Vulnerable to Unauthenticated Stored XSS on the Inventory page

GLPI exposes data to non-allowed users

GLPI's MailCollector Receiver is vulnerable to credential exfiltration

GLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API