Vulnerabilities in pluginsGLPI
14 resultsVexday analysis
O pluginsGLPI apresenta 14 vulnerabilidades catalogadas, com 3 classificadas como críticas, sendo a injeção SQL (CWE-89) o padrão predominante de fraqueza. Nenhuma vulnerabilidade está sob exploração ativa conhecida (KEV), mas o risco permanece elevado pela severidade das falhas existentes; apenas 1 CVE foi publicada nos últimos 90 dias, sugerindo que o padrão de descobertas está estável.
CVE-2021-43778CRITICALPath traversal in GLPI barcode pluginEPSS 52.7%CVE-2021-43779CRITICALRemote Command Execution vulnerabilityEPSS 9.1%CVE-2023-29006HIGHOrder GLPI plugin vulnerable to remote code execution from authenticated userEPSS 0.9%CVE-2023-28855MEDIUMFields GLPI plugin vulnerable to unauthorized write access to additional fieldsEPSS 0.6%CVE-2023-33971MEDIUMFormcreator vulnerable to stored XSS from ##FULLFORM##EPSS 0.6%CVE-2024-53850HIGHThe Addressing GLPI plugin allows data enumeration through uncontrolled object instantiationEPSS 0.5%CVE-2021-39190MEDIUMSCCM plugin for GLPI vulnerable to Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.5%CVE-2024-45600HIGHFields GLPI plugin has an Authenticated SQL InjectionEPSS 0.5%CVE-2025-65035MEDIUMGLPI Database Inventory Plugin Vulnerable to Stored Object InjectionEPSS 0.3%CVE-2026-11321HIGHGLPI DataInjection Plugin Authenticated SQL Injection via CSV ImportEPSS 0.3%CVE-2026-23489CRITICALFields GLPI plugin vulnerable to RCE in dropdown generationEPSS 0.3%CVE-2025-53360MEDIUMpluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requestsEPSS 0.3%CVE-2025-27153MEDIUMEscalade GLPI Plugin Vulnerable to Improper Access ControlEPSS 0.2%CVE-2026-22821MEDIUMmreporting affected by a SQLI on date changeEPSS 0.2%