pluginsGLPI has 2 CVEs on record. The median CVSS is 6.4 (medium).
CVEs per month
Last 12 months, by publish date
1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.4
- Publish → KEV
- —
- Last 90 days
- 0 prev 2
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-11321Medium· 6.4The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection35CVE-2026-53987Medium· 6.4Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering35
pluginsGLPI vulnerabilities
CVEs affecting pluginsGLPI, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-11321Medium· 6.4The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection
The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authent…
▾ SunlitpluginsGLPI · datainjectionEPSS 0.42%via NVD
CVE-2026-53987Medium· 6.4Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering
The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An…
▾ SunlitpluginsGLPI · tagEPSS 0.50%via CVEORG