GLPI 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk sql injection、パス処理の欠陥、vendor risk ssrf, and vendor risk csrf があり、vendor surface production workloads and vendor surface software deployment の利用場面で vendor impact data exposure、ファイル上書き, and vendor impact unexpected behavior などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2026-32312 | GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7. | [email protected] | 5.1 | 0.22% | 2026-05-18 | 2026-06-17 |
| CVE-2026-29047 | GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6. | [email protected] | 7.2 | 0.39% | 2026-04-06 | 2026-06-17 |
| CVE-2026-26263 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6. | [email protected] | 8.1 | 0.28% | 2026-04-06 | 2026-06-17 |
| CVE-2026-26027 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6. | [email protected] | 7.5 | 0.19% | 2026-04-06 | 2026-06-17 |
| CVE-2026-26026 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6. | [email protected] | 9.1 | 0.37% | 2026-04-06 | 2026-06-17 |
| CVE-2026-25932 | GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24. | [email protected] | 7.2 | 0.28% | 2026-04-06 | 2026-06-17 |
| CVE-2026-26001 | The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6. | [email protected] | 7.1 | 0.21% | 2026-03-17 | 2026-06-17 |
| CVE-2026-25590 | The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6. | [email protected] | 4.5 | 0.17% | 2026-03-03 | 2026-06-17 |
| CVE-2026-22821 | mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4. | [email protected] | 4.9 | 0.24% | 2026-02-12 | 2026-06-17 |
| CVE-2026-23624 | GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions . | [email protected] | 4.3 | 0.37% | 2026-02-04 | 2026-06-17 |
| CVE-2026-22247 | GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5. | [email protected] | 4.1 | 0.32% | 2026-02-04 | 2026-06-17 |
| CVE-2026-22044 | GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23. | [email protected] | 6.5 | 0.26% | 2026-02-04 | 2026-06-17 |
| CVE-2025-66417 | GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 11.0.3. | [email protected] | 7.5 | 0.44% | 2026-01-15 | 2026-06-17 |
| CVE-2025-64516 | GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3. | [email protected] | 7.5 | 0.28% | 2026-01-15 | 2026-06-17 |
| CVE-2023-53943 | GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts. | [email protected] | 6.9 | 0.30% | 2025-12-18 | 2026-06-17 |
| CVE-2025-64520 | GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch. | [email protected] | 6.5 | 0.19% | 2025-12-16 | 2026-06-17 |
| CVE-2025-59935 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch. | [email protected] | 6.5 | 0.24% | 2025-12-16 | 2026-06-17 |
| CVE-2025-53357 | GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.78 through 10.0.18, a connected user can alter the reservations of another user. This is fixed in version 10.0.19. | [email protected] | 5.4 | 0.17% | 2025-07-30 | 2026-06-17 |
| CVE-2025-53113 | GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do not have the right to see. This is fixed in version 10.0.19. | [email protected] | 2.7 | 0.20% | 2025-07-30 | 2026-06-17 |
| CVE-2025-53112 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.19. | [email protected] | 4.3 | 0.18% | 2025-07-30 | 2026-06-17 |