glpi-project
Number 99 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: Glpi-Project, glpi-project
Total vulnerabilities
190
Critical
11
High
76
Known Exploited
0
Exploit available
1
Network, no login needed
30.5%
Of 190 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 43 | 3 | 24 | 15 | 1 | 0 |
| 2025 | 23 | 0 | 6 | 15 | 2 | 0 |
| 2024 | 34 | 2 | 14 | 18 | 0 | 0 |
| 2023 | 35 | 3 | 14 | 17 | 1 | 0 |
| 2022 | 27 | 3 | 5 | 15 | 4 | 0 |
| 2021 | 13 | 0 | 2 | 11 | 0 | 0 |
| 2020 | 15 | 0 | 11 | 4 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| glpi | 170 | 75 |
| GLPI | 10 | 6 |
| glpi-inventory-plugin | 7 | 3 |
| glpi-agent | 3 | 3 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Cross-Site Scripting | 45 | 10 |
| SQL Injection | 38 | 28 |
| Missing Authorization | 15 | 7 |
| Improper Access Control | 14 | 6 |
| Information Disclosure | 10 | 2 |
| Privilege Escalation | 8 | 6 |
| Improper Authorization | 6 | 0 |
| Path Traversal | 6 | 4 |
| Server-Side Request Forgery | 6 | 0 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 4 | 2 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-57152 | GLPI: Unallowed notifications sending | High | 0.2% | |
| CVE-2026-53631 | GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds | Medium | 0.2% | |
| CVE-2026-52848 | GLPI: MFA bypass | Critical | 0.4% | |
| CVE-2026-47678 | GLPI: Blind Time based SQLI in dropdowns | High | 0.2% | |
| CVE-2026-121559 | GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning | High | 0.5% | |
| CVE-2026-108726 | GLPI through 12.0.0 Missing Authorization via ajax/map.php | Medium | 0.3% | |
| CVE-2026-55217 | GLPI: Unallowed modfication of knowbase items comments and translations | Medium | 0.3% | |
| CVE-2026-55214 | GLPI: Stored XSS in suppliers | High | 0.3% | |
| CVE-2026-53629 | GLPI: SQL injection in history tab | High | 1.0% | |
| CVE-2026-53628 | GLPI: Unallowed authentication method update by administrator | Medium | 0.5% |