{"schema_version":1,"title":"GLPI Project vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 14 vulnerabilities in GLPI Project: 11 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-55217, was published on 25 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/glpi-project","json_url":"https://junglewise.ai/threats/vendors/glpi-project.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/glpi-project","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":0,"all_time":14,"critical":0,"exploited":0,"last_7_days":11,"last_30_days":11,"last_90_days":13,"last_365_days":14},"latest":[{"cve":"CVE-2026-55217","slug":"cve-2026-55217-glpi-is-a-free-asset-and-it-management-software-package-from-0-85","title":"GLPI authorization bypass in knowledge base comments and translations","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:38.323+00:00","url":"https://junglewise.ai/threats/cve-2026-55217-glpi-is-a-free-asset-and-it-management-software-package-from-0-85"},{"cve":"CVE-2026-55214","slug":"cve-2026-55214-glpi-is-a-free-asset-and-it-management-software-package-from-11-0","title":"GLPI stored cross-site scripting in suppliers","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:38.16+00:00","url":"https://junglewise.ai/threats/cve-2026-55214-glpi-is-a-free-asset-and-it-management-software-package-from-11-0"},{"cve":"CVE-2026-53629","slug":"cve-2026-53629-glpi-is-a-free-asset-and-it-management-software-package-from-9-4","title":"GLPI SQL injection in history tab","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:28.263+00:00","url":"https://junglewise.ai/threats/cve-2026-53629-glpi-is-a-free-asset-and-it-management-software-package-from-9-4"},{"cve":"CVE-2026-53627","slug":"cve-2026-53627-glpi-is-a-free-asset-and-it-management-software-package-from-11-0","title":"GLPI authorization bypass in API update operations","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:27.87+00:00","url":"https://junglewise.ai/threats/cve-2026-53627-glpi-is-a-free-asset-and-it-management-software-package-from-11-0"},{"cve":"CVE-2026-53625","slug":"cve-2026-53625-glpi-is-a-free-asset-and-it-management-software-package-from-0-70","title":"GLPI authentication method manipulation in API","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:27.477+00:00","url":"https://junglewise.ai/threats/cve-2026-53625-glpi-is-a-free-asset-and-it-management-software-package-from-0-70"},{"cve":"CVE-2026-53610","slug":"cve-2026-53610-glpi-is-a-free-asset-and-it-management-software-package-from-11-0","title":"GLPI reflected cross-site scripting in dashboards","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:27.123+00:00","url":"https://junglewise.ai/threats/cve-2026-53610-glpi-is-a-free-asset-and-it-management-software-package-from-11-0"},{"cve":"CVE-2026-49470","slug":"cve-2026-49470-glpi-is-a-free-asset-and-it-management-software-package-from-11-0","title":"GLPI account takeover via 2FA brute force","severity":"info","exploited":false,"published_at":"2026-09-25T19:16:58.22+00:00","url":"https://junglewise.ai/threats/cve-2026-49470-glpi-is-a-free-asset-and-it-management-software-package-from-11-0"},{"cve":"CVE-2026-49469","slug":"cve-2026-49469-glpi-is-a-free-asset-and-it-management-software-package-from-0-70","title":"GLPI LDAP filter bypass in user import","severity":"info","exploited":false,"published_at":"2026-09-25T19:16:58.033+00:00","url":"https://junglewise.ai/threats/cve-2026-49469-glpi-is-a-free-asset-and-it-management-software-package-from-0-70"},{"cve":"CVE-2026-48482","slug":"cve-2026-48482-glpi-is-a-free-asset-and-it-management-software-package-from-11-0","title":"GLPI remote code execution via form import","severity":"info","exploited":false,"published_at":"2026-09-25T19:16:55.18+00:00","url":"https://junglewise.ai/threats/cve-2026-48482-glpi-is-a-free-asset-and-it-management-software-package-from-11-0"},{"cve":"CVE-2026-47679","slug":"cve-2026-47679-glpi-is-a-free-asset-and-it-management-software-package-from-10-0","title":"GLPI path traversal in profile picture upload","severity":"info","exploited":false,"published_at":"2026-09-25T19:16:54.967+00:00","url":"https://junglewise.ai/threats/cve-2026-47679-glpi-is-a-free-asset-and-it-management-software-package-from-10-0"},{"cve":"CVE-2026-45801","slug":"cve-2026-45801-glpi-is-a-free-asset-and-it-management-software-package-from-0-72","title":"GLPI privilege escalation in debug mode configuration","severity":"info","exploited":false,"published_at":"2026-09-25T19:16:53.747+00:00","url":"https://junglewise.ai/threats/cve-2026-45801-glpi-is-a-free-asset-and-it-management-software-package-from-0-72"},{"cve":"CVE-2026-11321","cvss":6.4,"slug":"cve-2026-11321-pluginsglpi-datainjection-sql-injection-in-csv-import","title":"pluginsGLPI DataInjection SQL injection in CSV import","severity":"medium","exploited":false,"published_at":"2026-07-10T20:16:45.453+00:00","url":"https://junglewise.ai/threats/cve-2026-11321-pluginsglpi-datainjection-sql-injection-in-csv-import"},{"cve":"CVE-2026-53987","cvss":6.4,"slug":"cve-2026-53987-pluginsglpi-tag-plugin-for-glpi-stored-xss-in-kanban-view","title":"pluginsGLPI Tag plugin for GLPI stored XSS in Kanban view","severity":"medium","exploited":false,"published_at":"2026-07-09T17:17:01.277+00:00","url":"https://junglewise.ai/threats/cve-2026-53987-pluginsglpi-tag-plugin-for-glpi-stored-xss-in-kanban-view"},{"cve":"CVE-2026-32312","cvss":5.1,"slug":"cve-2026-32312-glpi-missing-authorization-in-form-structure-export","title":"GLPI missing authorization in form structure export","severity":"info","exploited":false,"published_at":"2026-05-19T00:16:37.283+00:00","url":"https://junglewise.ai/threats/cve-2026-32312-glpi-missing-authorization-in-form-structure-export"}],"vendor":{"hub":true,"name":"GLPI Project","slug":"glpi-project","homepage":"https://glpi-project.org/","description":"The organization responsible for the development and maintenance of the GLPI open-source asset and IT service management software.","url":"https://junglewise.ai/threats/vendors/glpi-project"},"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":11},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-11321","cvss":6.4,"slug":"cve-2026-11321-pluginsglpi-datainjection-sql-injection-in-csv-import","title":"pluginsGLPI DataInjection SQL injection in CSV import","severity":"medium","exploited":false,"published_at":"2026-07-10T20:16:45.453+00:00","url":"https://junglewise.ai/threats/cve-2026-11321-pluginsglpi-datainjection-sql-injection-in-csv-import"},{"cve":"CVE-2026-53987","cvss":6.4,"slug":"cve-2026-53987-pluginsglpi-tag-plugin-for-glpi-stored-xss-in-kanban-view","title":"pluginsGLPI Tag plugin for GLPI stored XSS in Kanban view","severity":"medium","exploited":false,"published_at":"2026-07-09T17:17:01.277+00:00","url":"https://junglewise.ai/threats/cve-2026-53987-pluginsglpi-tag-plugin-for-glpi-stored-xss-in-kanban-view"},{"cve":"CVE-2026-32312","cvss":5.1,"slug":"cve-2026-32312-glpi-missing-authorization-in-form-structure-export","title":"GLPI missing authorization in form structure export","severity":"info","exploited":false,"published_at":"2026-05-19T00:16:37.283+00:00","url":"https://junglewise.ai/threats/cve-2026-32312-glpi-missing-authorization-in-form-structure-export"},{"cve":"CVE-2026-55217","slug":"cve-2026-55217-glpi-is-a-free-asset-and-it-management-software-package-from-0-85","title":"GLPI authorization bypass in knowledge base comments and translations","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:38.323+00:00","url":"https://junglewise.ai/threats/cve-2026-55217-glpi-is-a-free-asset-and-it-management-software-package-from-0-85"},{"cve":"CVE-2026-55214","slug":"cve-2026-55214-glpi-is-a-free-asset-and-it-management-software-package-from-11-0","title":"GLPI stored cross-site scripting in suppliers","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:38.16+00:00","url":"https://junglewise.ai/threats/cve-2026-55214-glpi-is-a-free-asset-and-it-management-software-package-from-11-0"},{"cve":"CVE-2026-53629","slug":"cve-2026-53629-glpi-is-a-free-asset-and-it-management-software-package-from-9-4","title":"GLPI SQL injection in history tab","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:28.263+00:00","url":"https://junglewise.ai/threats/cve-2026-53629-glpi-is-a-free-asset-and-it-management-software-package-from-9-4"},{"cve":"CVE-2026-53627","slug":"cve-2026-53627-glpi-is-a-free-asset-and-it-management-software-package-from-11-0","title":"GLPI authorization bypass in API update operations","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:27.87+00:00","url":"https://junglewise.ai/threats/cve-2026-53627-glpi-is-a-free-asset-and-it-management-software-package-from-11-0"},{"cve":"CVE-2026-53625","slug":"cve-2026-53625-glpi-is-a-free-asset-and-it-management-software-package-from-0-70","title":"GLPI authentication method manipulation in API","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:27.477+00:00","url":"https://junglewise.ai/threats/cve-2026-53625-glpi-is-a-free-asset-and-it-management-software-package-from-0-70"},{"cve":"CVE-2026-53610","slug":"cve-2026-53610-glpi-is-a-free-asset-and-it-management-software-package-from-11-0","title":"GLPI reflected cross-site scripting in dashboards","severity":"info","exploited":false,"published_at":"2026-09-25T19:17:27.123+00:00","url":"https://junglewise.ai/threats/cve-2026-53610-glpi-is-a-free-asset-and-it-management-software-package-from-11-0"},{"cve":"CVE-2026-49470","slug":"cve-2026-49470-glpi-is-a-free-asset-and-it-management-software-package-from-11-0","title":"GLPI account takeover via 2FA brute force","severity":"info","exploited":false,"published_at":"2026-09-25T19:16:58.22+00:00","url":"https://junglewise.ai/threats/cve-2026-49470-glpi-is-a-free-asset-and-it-management-software-package-from-11-0"}],"generated_at":"2026-09-28T03:07:00.154823+00:00","technologies":[{"name":"GLPI Project GLPI","slug":"glpi-project-glpi","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/glpi-project-glpi"}]}