CVE-2026-47678High· 8.7▾ TwilightGLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This per…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.
glpi >= 9.4.0, < 10.0.26glpi >= 11.0.0, < 11.0.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53629High· 7.1GLPI is a free asset and IT management software package
CVE-2026-57152High· 7.1GLPI: Unallowed notifications sending
CVE-2026-49469Medium· 4.6GLPI is a free asset and IT management software package
CVE-2026-45801Medium· 5.3GLPI is a free asset and IT management software package
CVE-2026-53628Medium· 5.9GLPI is a free asset and IT management software package
CVE-2026-55217Medium· 5.3GLPI is a free asset and IT management software package