ITFlow

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

ITFlow records in CISA KEV

No ITFlow vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Itflow 2 records MEDIUM

Records

3 records

TI-2024-16700 CVE-2024-25344 · GHSA-35j4-pxc2-3gcf

Cross Site Scripting vulnerability in ITFlow.org before commit…

MEDIUM 60

Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code and obtain sensitive information via the settings.php, settings…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00741 Published 2024-02-26 No fix listed CWE-79

TI-2025-41123 CVE-2025-67081 · GHSA-h33f-9445-56j6

An SQL injection vulnerability in Itflow through 25.06 has been identified in the…

MEDIUM 56

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00285 Published 2026-01-15 No fix listed CWE-89

TI-2026-64272 CVE-2026-97735 · GHSA-6phr-xx43-2pr6

Cross-site scripting in ITFlow

LOW 36

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00254 Published 2026-09-25 Fixed in 26.08 CWE-79

Open these records in search →

Critical	0
High	1
Medium	2
Low	0
No CVSS	0