Skip to content
OpenAdvisories

Vendor

pluginsGLPI

15 known vulnerabilities.

Products

fields 3 addressing 2 databaseinventory 2 sccm 1 order 1 mreporting 1 formcreator 1 datainjection 1 tag 1 escalade 1 barcode 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-11321

    GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import

    The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with acces…

    pluginsGLPI datainjection
  • Medium 6.4
    CVE-2026-53987

    Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering

    The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user wi…

    pluginsGLPI tag
  • Medium 4.9
    CVE-2026-22821

    mreporting affected by a SQLI on date change

    mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4.

    pluginsGLPI mreporting
  • Medium 6.4
    CVE-2025-65035

    GLPI Database Inventory Plugin Vulnerable to Stored Object Injection

    pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions (database write access must first be obtained through an…

    pluginsGLPI databaseinventory
  • Medium 4.3
    CVE-2025-53360

    pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests

    pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. In versions prior to 1.0.3, any authenticated user could send requests to agents. This issue has been …

    pluginsGLPI databaseinventory
  • Medium 6.5
    CVE-2025-27153

    Escalade GLPI Plugin Vulnerable to Improper Access Control

    Escalade GLPI plugin is a ticket escalation process helper for GLPI. Prior to version 2.9.11, there is an improper access control vulnerability. This can lead to data exposure and workflow disruptions. This issue has been patched in version 2.9.11.

    pluginsGLPI escalade
  • Medium 6.1
    CVE-2023-33971

    Formcreator vulnerable to stored XSS from ##FULLFORM##

    Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probable stored cross-site scripting vulnerability is present in Formcreator 2.13.5 and prior via the use of the use of `##FUL…

    pluginsGLPI formcreator
  • Medium 6.5
    CVE-2023-28855

    Fields GLPI plugin vulnerable to unauthorized write access to additional fields

    Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no co…

    pluginsGLPI fields
  • Medium 5.3
    CVE-2021-39190

    SCCM plugin for GLPI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

    The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuration page is publicly accessible in read-only mode. This issue is patched in version 2.3.0. No known workarounds exist.

    pluginsGLPI sccm