Vulnerabilidades em glpi-project

188 resultados
Análise Vexday

Com 167 CVEs catalogadas e nenhuma confirmada em exploração ativa no catálogo KEV da CISA, o glpi-project apresenta taxa de exploração abaixo da média geral do catálogo, o que não elimina o risco considerando o volume total e a velocidade de novos registros — 13 vulnerabilidades surgiram nos últimos 90 dias. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em aplicações web de gestão, e o ponto de maior atenção imediata é CVE-2025-24799, que registra EPSS de 0,8618 — indicando alta probabilidade estimada de exploração em curto prazo — e deve ser priorizada nas equipes de resposta. Das 8 CVEs críticas catalogadas, 4 possuem prova de conceito pública disponível, o que reduz a barreira técnica para tentativas de exploração e exige atenção redobrada em ambientes que não aplicaram as correções correspondentes.

CVE-2023-22500HIGHglpi Unauthorized access to inventory filesEPSS 0.9%CVE-2023-51446MEDIUMGLPI LDAP Injection during authenticationEPSS 0.9%CVE-2022-31143MEDIUMLeak of sensitive information through login page error in GLPIEPSS 0.9%CVE-2021-21255MEDIUMentities switch IDOREPSS 0.9%CVE-2022-29250HIGHSQL injection in GLPIEPSS 0.8%CVE-2024-27914MEDIUMReflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPIEPSS 0.8%CVE-2023-28634HIGHGLPI vulnerable to Privilege Escalation from Technician to Super-AdminEPSS 0.8%CVE-2022-39262MEDIUMStored Cross-Site Scripting (XSS) on login page in GLPIEPSS 0.8%CVE-2020-11036HIGHXSS in GLPIEPSS 0.8%CVE-2023-34254HIGHRemote inventory task command injection when using ssh command modeEPSS 0.8%CVE-2022-24869MEDIUMCross Site Scripting in GLPIEPSS 0.8%CVE-2020-15177HIGHUnauthenticated Stored XSS in GLPIEPSS 0.8%CVE-2023-28838CRITICALGLPI vulnerable to SQL injection through dynamic reportsEPSS 0.8%CVE-2022-39276LOWBlind Server-Side Request Forgery (SSRF) in RSS feeds and planningEPSS 0.8%CVE-2023-23610MEDIUMglpi vulnerable to Unauthorized access to data exportEPSS 0.8%CVE-2022-31187MEDIUMStored Cross Site Scripting (XSS) through global search in GLPIEPSS 0.7%CVE-2023-37278MEDIUMGLPI vulnerable to SQL injection via dashboard administrationEPSS 0.7%CVE-2022-39277MEDIUMCross-Site Scripting (XSS) in external links in GLPIEPSS 0.7%CVE-2024-37147MEDIUMGLPI allows Authenticated File Upload to Restricted TicketsEPSS 0.7%CVE-2022-35945MEDIUMCross site scripting (XSS) via registration API in GLPIEPSS 0.7%