# Glpi-Project Glpi


- [CVE-2022-35914](https://insights.sbomify.com/CVE-2022-35914/): Teclib GLPI Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2023-42802](https://insights.sbomify.com/CVE-2023-42802/): GLPI vulnerable to unallowed PHP script execution (critical 10.0)
- [CVE-2023-28849](https://insights.sbomify.com/CVE-2023-28849/): GLPI vulnerable to SQL injection and Stored XSS via inventory agent request (critical 10.0)
- [CVE-2022-35947](https://insights.sbomify.com/CVE-2022-35947/): SQL injection in GLPI (critical 10.0)
- [CVE-2022-31056](https://insights.sbomify.com/CVE-2022-31056/): SQL injection with _actor parameter in GLPI (critical 9.8)
- [CVE-2022-31061](https://insights.sbomify.com/CVE-2022-31061/): SQL injection on login page in GLPI (critical 9.8)
- [CVE-2021-44617](https://insights.sbomify.com/CVE-2021-44617/): SQL injection in n/a (critical 9.8)
- [CVE-2017-11184](https://insights.sbomify.com/CVE-2017-11184/): SQL injection in n/a (critical 9.8)
- [CVE-2017-11474](https://insights.sbomify.com/CVE-2017-11474/): SQL injection in n/a (critical 9.8)
- [CVE-2017-11329](https://insights.sbomify.com/CVE-2017-11329/): SQL injection in n/a (critical 9.8)
- [CVE-2023-28838](https://insights.sbomify.com/CVE-2023-28838/): GLPI vulnerable to SQL injection through dynamic reports (critical 9.6)
- [CVE-2024-50339](https://insights.sbomify.com/CVE-2024-50339/): GLPI vulnerable to unauthenticated session hijacking (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/products/glpi-project/glpi/