{"items":[{"id":"CVE-2026-11321","published":"2026-07-10T18:53:56.004Z","updated":"2026-07-30T14:39:12.341Z","title":"GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import","severity":"HIGH","score":7.1,"vendor":"pluginsGLPI","product":"datainjection","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-53987","published":"2026-07-09T15:44:04.474Z","updated":"2026-10-29T21:15:42.701Z","title":"Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering","severity":"HIGH","score":7.3,"vendor":"pluginsGLPI","product":"tag","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-23489","published":"2026-03-16T17:12:43.964Z","updated":"2026-03-16T17:51:31.011Z","title":"Fields GLPI plugin vulnerable to RCE in dropdown generation","severity":"CRITICAL","score":9.1,"vendor":"pluginsGLPI","product":"fields","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-22821","published":"2026-02-12T18:43:59.249Z","updated":"2026-02-12T19:31:55.400Z","title":"mreporting affected by a SQLI on date change","severity":"MEDIUM","score":4.9,"vendor":"pluginsGLPI","product":"mreporting","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-65035","published":"2025-12-19T16:35:56.944Z","updated":"2025-12-19T18:00:25.116Z","title":"GLPI Database Inventory Plugin Vulnerable to Stored Object Injection","severity":"MEDIUM","score":6.4,"vendor":"pluginsGLPI","product":"databaseinventory","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2025-53360","published":"2025-11-18T16:12:15.116Z","updated":"2025-11-18T18:22:25.605Z","title":"pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests","severity":"MEDIUM","score":4.3,"vendor":"pluginsGLPI","product":"databaseinventory","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2025-27153","published":"2025-07-01T18:27:50.677Z","updated":"2025-07-01T19:35:43.790Z","title":"Escalade GLPI Plugin Vulnerable to Improper Access Control","severity":"MEDIUM","score":6.5,"vendor":"pluginsGLPI","product":"escalade","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2024-53850","published":"2024-12-26T21:41:55.270Z","updated":"2024-12-27T16:18:41.207Z","title":"The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation","severity":"HIGH","score":8.2,"vendor":"pluginsGLPI","product":"addressing","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2024-45600","published":"2024-12-26T21:27:01.168Z","updated":"2024-12-30T14:53:26.436Z","title":"Fields GLPI plugin has an Authenticated SQL Injection","severity":"HIGH","score":7.7,"vendor":"pluginsGLPI","product":"fields","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2023-33971","published":"2023-05-31T17:56:18.413Z","updated":"2025-01-09T20:20:40.283Z","title":"Formcreator vulnerable to stored XSS from ##FULLFORM##","severity":"MEDIUM","score":6.1,"vendor":"pluginsGLPI","product":"formcreator","kev":false,"epss":0.00551,"kevAdded":null},{"id":"CVE-2023-29006","published":"2023-04-05T17:53:03.041Z","updated":"2025-02-10T15:23:39.714Z","title":"Order GLPI plugin vulnerable to remote code execution from authenticated user","severity":"HIGH","score":8.8,"vendor":"pluginsGLPI","product":"order","kev":false,"epss":0.00857,"kevAdded":null},{"id":"CVE-2023-28855","published":"2023-04-05T17:48:22.384Z","updated":"2025-02-10T16:27:40.112Z","title":"Fields GLPI plugin vulnerable to unauthorized write access to additional fields","severity":"MEDIUM","score":6.5,"vendor":"pluginsGLPI","product":"fields","kev":false,"epss":0.00611,"kevAdded":null},{"id":"CVE-2021-39190","published":"2022-09-22T16:30:15.000Z","updated":"2025-04-23T16:56:34.675Z","title":"SCCM plugin for GLPI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","severity":"MEDIUM","score":5.3,"vendor":"pluginsGLPI","product":"sccm","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2021-43779","published":"2022-01-05T18:45:11.000Z","updated":"2025-09-08T15:33:16.901Z","title":"Remote Command Execution vulnerability","severity":"CRITICAL","score":9.9,"vendor":"pluginsGLPI","product":"addressing","kev":false,"epss":0.0913,"kevAdded":null},{"id":"CVE-2021-43778","published":"2021-11-24T18:50:10.000Z","updated":"2025-09-08T15:26:50.189Z","title":"Path traversal in GLPI barcode plugin","severity":"CRITICAL","score":9.1,"vendor":"pluginsGLPI","product":"barcode","kev":false,"epss":0.52658,"kevAdded":null}]}