Glpi-project Glpi-inventory-plugin vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Glpi-project Glpi-inventory-plugin: 3 record(s), with affected versions and fixes.

CVE-2026-26001 High · 8.8 CWE-89 Mar 17, 2026

GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.

CVE-2026-25590 Medium · 6.1 CWE-79 Mar 3, 2026

GLPI Inventory Plugin has Reflected XSS in task jobs

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6.

CVE-2025-32786 High · 7.5 CWE-89 Nov 4, 2025

GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1.