repository icon
glpi-project / glpi Project repository

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.

Submit a report

FIRST INTERACTION

WITHIN1 DAY

REVIEW

WITHIN11 DAYS

FIX

WITHIN130 DAYS

SQL Injection in GLPI leads to Account takeover and RCE
guilhem7
High
Weak Password Policy
hainguyen0207
informative
High
Improper Access Control That Leads to Privilege Escalation / Account Takeover
annfalotaibi
High
SQL Injection
guilhem7
Medium
Stored XSS in front/dashboard_helpdesk.php
007nicky
Medium
Stored XSS
007nicky
self closed
IDOR on save email configuration leads to account takeover
k1000o23
High
XSS on external links bypass filters
edr4
Medium
SQL Injection at /front/report.dynamic.php
carlosevieira
High
Arbitrary File Upload Led to Cross-Site Scripting Stored
jeffreygaor
informative
High
XSS,Set window.name via target attribute in a tag to bypass the protection
christynorl
self closed
Authenticated Reflected XSS on ajax/common.tabs.php
c3l3si4n
Medium
XSS on external links
edr4
Medium
Stored XSS - XSS in RSS link href attribute
xanhacks
Medium
Post-Based-RXSS at /vendor/htmlawed/htmlawed/htmLawedTest.php via (inputH & outp...
omarhashem123
spam
XSS in RSS Description Link
edr4
Medium
Self XSS on Kanban tickets
xanhacks
spam
XSS Stored inside help links onevent attribute
xanhacks
Low
XSS Stored inside Standard Interface Help Link href attribute
xanhacks
Low
Improper Input Validation on emails links
xanhacks
Low
GLPI - External links XSS Stored
edr4
duplicate
Medium
SSRF (Server-Side Request Forgery) - Blind SSRF on External Calendar creation
xanhacks
self closed
Stored XSS - XSS in RSS link
xanhacks
Medium
Stored XSS - Entity name not sanitize in Ticket creation page
xanhacks
Medium
XSS on external links
w0rty
Medium
SSRF in feeds
w0rty
Low
Stored XSS
mike993
Medium
Improper Handling of document files maximum size
seifallahhomrani1
not applicable
User's session persist after permanently deleting his account
seifallahhomrani1
Medium
•CVE-2022-39234
Blind SSRF on the RSS Feed
seifallahhomrani1
Low
•CVE-2022-36112
Weak Password Policy
tharunavula
not applicable
SQL Injection
bull53y3fl1nch
High
•$45
Use of GET Request Method With Sensitive Query Strings
laddnad
Medium
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$40
Sensitive Cookie Without 'HttpOnly' Flag
am0o0
Medium
•$40