Vulnerabilities

TI-2025-39611 CVE-2025-64167

Combodo iTop vulnerable to reflected XSS in webservices/export.php

LOW 31

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0025 Published 2025-11-10 Fixed in 2.7.13, 3.2.2 CWE-79

TI-2025-31225 CVE-2025-49145

iTop admin can drop iTop database using webhooks

MEDIUM 40

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00322 Published 2025-11-10 Fixed in 2.7.13, 3.2.2 CWE-863

TI-2025-31028 CVE-2025-48878

Combodo iTop vulnerable to IDOR with ModuleInstallation object

LOW 19

Combodo iTop is a web based IT service management tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00211 Published 2025-11-10 Fixed in 3.2.2 CWE-862

TI-2025-30436 CVE-2025-48065

Combodo iTop vulnerable to reflected XSS via objection edition form error

MEDIUM 40

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00238 Published 2025-11-10 Fixed in 2.7.13, 3.2.2 CWE-79

TI-2025-30426 CVE-2025-48055

Combodo iTop has stored XSS in user portal's browse brick

LOW 36

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00192 Published 2025-11-10 Fixed in 3.2.2 CWE-79

TI-2025-30325 CVE-2025-47932

Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard

MEDIUM 40

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00238 Published 2025-11-10 Fixed in 2.7.13, 3.2.2 CWE-79

TI-2025-30238 CVE-2025-47773

Combodo iTop has XSS vulnerability in /pages/ajax.render.php

MEDIUM 40

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00238 Published 2025-11-10 Fixed in 2.7.13, 3.2.2 CWE-79

TI-2025-29816 CVE-2025-47286

Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality

MEDIUM 40

Combodo iTop is a web based IT service management tool.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.005 Published 2025-11-10 Fixed in 2.7.13, 3.2.2 CWE-74

TI-2025-18649 CVE-2025-24969

iTop portal user can see any other contact's picture

LOW 23

iTop is an web based IT Service Management tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00281 Published 2025-05-14 Fixed in 3.2.1 CWE-639

TI-2025-18502 CVE-2025-24785

iTop dashboard vulnerable to denial of service

LOW 20

iTop is an web based IT Service Management tool.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00293 Published 2025-05-14 No fix listed CWE-20

TI-2025-17793 CVE-2025-24026

iTop Inefficient Regular Expression Complexity vulnerability

LOW 24

iTop is an web based IT Service Management tool.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00332 Published 2025-05-14 Fixed in 3.2.1 CWE-1333

TI-2025-17789 CVE-2025-24022

iTop server vulnerable to portal code injection

MEDIUM 40

iTop is an web based IT Service Management tool.

CVSS 3.1HIGH 8.6 Network Low privileges No interaction EPSS 0.00656 Published 2025-05-14 Fixed in 2.7.12, 3.1.3 +1 CWE-78

TI-2025-17788 CVE-2025-24021

iTop doesn't have mass assignment of fields in the portal form

LOW 22

iTop is an web based IT Service Management tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00267 Published 2025-05-14 Fixed in 2.7.12, 3.1.3 +1 CWE-862

TI-2024-37140 CVE-2024-56157

iTop vulnerable to Self XSS in CSV Import

LOW 28

iTop is an web based IT Service Management tool.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00283 Published 2025-05-14 Fixed in 3.1.3, 3.2.1 CWE-79

TI-2024-35261 CVE-2024-52601

iTop portal Insecure Direct Object Reference vulnerability

LOW 29

iTop is an web based IT Service Management tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00348 Published 2025-05-14 Fixed in 2.7.12, 3.1.3 +1 CWE-639

TI-2025-19996 CVE-2025-27139

Combodo iTop vulnerable to stored self Cross-site Scripting in preferences

LOW 30

Combodo iTop is a web based IT service management tool.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00241 Published 2025-02-25 Fixed in 2.7.12, 3.1.2 +1 CWE-79

TI-2024-36255 CVE-2024-54139

Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter

MEDIUM 42

Combodo iTop is an open source and web-based IT service management platform.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00217 Published 2024-12-13 Fixed in 2.7.11, 3.1.2 +1 CWE-352

TI-2024-34887 CVE-2024-52000

Reflected Cross-site Scripting exploit in Combodo iTop

LOW 27

Combodo iTop is a simple, web based IT Service Management tool.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00381 Published 2024-11-08 Fixed in 3.2.0 CWE-79

TI-2024-34888 CVE-2024-52001

Portal user is able to access forbidden services information in Combodo iTop

LOW 20

Combodo iTop is a simple, web based IT Service Management tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00297 Published 2024-11-08 Fixed in 3.2.0 CWE-200

TI-2024-34889 CVE-2024-52002

Cross-Site Request Forgery (CSRF) in several iTop pages

LOW 39

Combodo iTop is a simple, web based IT Service Management tool.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00717 Published 2024-11-08 Fixed in 3.2.0 CWE-352

TI-2024-34881 CVE-2024-51993

Password is stored in clear in the database in Combodo iTop

LOW 15

Combodo iTop is a web based IT Service Management tool.

CVSS 3.1LOW 3.4 Local High privileges No interaction EPSS 0.00111 Published 2024-11-07 Fixed in 3.2.0 CWE-312

TI-2024-34882 CVE-2024-51994

Cross-site Scripting in portal picture upload in Combodo iTop

LOW 31

Combodo iTop is a web based IT Service Management tool.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00359 Published 2024-11-07 Fixed in 3.2.0 CWE-79

TI-2024-34883 CVE-2024-51995

Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop

LOW 32

Combodo iTop is a web based IT Service Management tool.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00426 Published 2024-11-07 Fixed in 3.2.0 CWE-284

TI-2024-34646 CVE-2024-51740

SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop

LOW 39

Combodo iTop is a simple, web based IT Service Management tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00544 Published 2024-11-05 Fixed in 2.7.11, 3.0.5 +1 CWE-918

TI-2024-34645 CVE-2024-51739

Users enumeration allowed through Rest API in Combodo iTop

MEDIUM 41

Combodo iTop is a simple, web based IT Service Management tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01232 Published 2024-11-05 Fixed in 2.7.11, 3.0.5 +1 CWE-200

Vulnerabilities

Filters