Vulnerabilidades em glpi-project

188 resultados
Análise Vexday

Com 167 CVEs catalogadas e nenhuma confirmada em exploração ativa no catálogo KEV da CISA, o glpi-project apresenta taxa de exploração abaixo da média geral do catálogo, o que não elimina o risco considerando o volume total e a velocidade de novos registros — 13 vulnerabilidades surgiram nos últimos 90 dias. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em aplicações web de gestão, e o ponto de maior atenção imediata é CVE-2025-24799, que registra EPSS de 0,8618 — indicando alta probabilidade estimada de exploração em curto prazo — e deve ser priorizada nas equipes de resposta. Das 8 CVEs críticas catalogadas, 4 possuem prova de conceito pública disponível, o que reduz a barreira técnica para tentativas de exploração e exige atenção redobrada em ambientes que não aplicaram as correções correspondentes.

CVE-2025-53111MEDIUMGLPI exposes data to non-allowed usersEPSS 0.3%CVE-2025-53008MEDIUMGLPI's MailCollector Receiver is vulnerable to credential exfiltrationEPSS 0.3%CVE-2026-42318HIGHGLPI Vulnerable to Arbitrary Item Deletion via Planning EndpointEPSS 0.3%CVE-2026-53626HIGHGLPI: Arbitrary Document Read via Form Context Authorization BypassEPSS 0.3%CVE-2025-59935MEDIUMGLPI Vulnerable to Unauthenticated Stored XSS on the Inventory pageEPSS 0.3%CVE-2026-25932HIGHGLPI has Stored XSS in Supplier 'Website' fieldEPSS 0.3%CVE-2025-23024MEDIUMGLPI: Plugins are disabled accessing one pageEPSS 0.3%CVE-2026-55214HIGHGLPI: Stored XSS in suppliersEPSS 0.3%CVE-2025-53113LOWGLPI technicians can access unauthorized information through external linksEPSS 0.3%CVE-2026-40108HIGHGLPI Vulnerable to Stored XSS in ITIL CostsEPSS 0.3%CVE-2025-52897MEDIUMGLPI is vulnerable to XSS and open redirection attacks through planning featureEPSS 0.3%CVE-2026-108726MEDIUMGLPI through 12.0.0 Missing Authorization via ajax/map.phpEPSS 0.3%CVE-2026-44281HIGHGLPI vulnerable to unauthorized reading of a specific asset objectEPSS 0.3%CVE-2026-53631MEDIUMGLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feedsEPSS 0.2%CVE-2026-57152HIGHGLPI: Unallowed notifications sendingEPSS 0.2%CVE-2026-42320MEDIUMGLPI vulnerable to arbitrary file accessEPSS 0.2%CVE-2026-47678HIGHGLPI: Blind Time based SQLI in dropdownsEPSS 0.2%CVE-2025-53112MEDIUMGLPI's incomprehensive permission checks can lead to data removal from allowed usersEPSS 0.2%CVE-2026-26001HIGHGLPI Inventory Plugin has SQL Injection on dropdown_calendar ReportEPSS 0.2%CVE-2024-28240HIGHGLPI-Agent's MSI package installation permits local users to change Agent configurationEPSS 0.2%