CVE-2024-43416: high-severity vulnerability in glpi-project glpi
GLPI vulnerable to enumeration of users' email addresses by unauthenticated user
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.2%
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
glpi-project · glpiRelated CVEs — glpi-project glpi
In the same product, most dangerous first.
CVE-2025-24799HIGHGLPI allows unauthenticated SQL injection through the inventory endpointEPSS 86.8%CVE-2020-15175HIGHUnauthenticated File Deletion in GLPIEPSS 69.9%CVE-2023-46727HIGHGLPI SQL injection through inventory agent requestEPSS 67.7%CVE-2024-29889HIGHGLPI contains an SQL injection through the saved searchesEPSS 64.7%CVE-2024-31456HIGHGLPI contains an authenticated SQL injectionEPSS 59.1%CVE-2024-27096HIGHSQL Injection in through the search engineEPSS 58.8%