Glpi Project: community verdicts
2 notable / known-exploited Glpi Project CVEs the community has triaged.
ⓘ Not an exhaustive list: we focus on the findings that matter (exploited / notable). For every Glpi Project CVE, see NVD ↗.
Show as table
| Year published | CVEs | In CISA KEV |
|---|---|---|
| 2022 | 1 | 1 |
| 2023 | 0 | 0 |
| 2024 | 0 | 0 |
| 2025 | 0 | 0 |
| 2026 | 1 | 0 |
Exploitation first, with newly exploited CVEs rising above old ones
- CVE-2022-35914CRIT 9.8KEVEPSS 100%
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
- CVE-2026-26026CRIT 9.1EPSS 12%
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.