Vulnerabilities

Filters

1 selected

104 records

Sort

Vendor: Combodo Clear all filters

TI-2026-70696 CVE-2026-108717 · GHSA-p2cr-76v5-5835

Missing authorization in Combodo iTop LinkSetController lets users bypass grants

LOW 24

Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00264 Published 2026-10-11 No fix listed CWE-862

TI-2026-29533 CVE-2026-40877

Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences

MEDIUM 40

Combodo iTop is a web-based IT service management tool.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00533 Published 2026-08-24 Fixed in 3.2.3 CWE-502

TI-2026-23693 CVE-2026-30864

Combodo iTop: Reflected XSS in dashboard revert

MEDIUM 40

Combodo iTop is a web-based IT service management tool.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00352 Published 2026-08-24 Fixed in 3.2.3 CWE-79

TI-2026-28831 CVE-2026-39975

Combodo iTop: Remote code execution using external auth variable value

MEDIUM 43

Combodo iTop is a web-based IT service management tool.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00591 Published 2026-08-24 Fixed in 3.2.3 CWE-94

TI-2026-27173 CVE-2026-34949

Combodo iTop: Unauthenticated user can delete .readonly file

LOW 35

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performi…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00373 Published 2026-08-21 Fixed in 3.2.3 CWE-306

TI-2026-27172 CVE-2026-34948

Combodo iTop: Access control bypass via OQL joins

LOW 34

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00386 Published 2026-08-21 Fixed in 3.2.3 CWE-200

TI-2026-27080 CVE-2026-34836

Combodo iTop: Improper access control in ajax.render.php and ajax.document.php

LOW 29

Combodo iTop is a web based IT service management tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00385 Published 2026-08-21 Fixed in 3.2.3 CWE-862

TI-2026-26985 CVE-2026-34741

Combodo iTop: Authentication bypass in exec.php allows PHP file execution

MEDIUM 44

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00635 Published 2026-08-21 Fixed in 3.2.3 CWE-306

TI-2026-25743 CVE-2026-33333

Combodo iTop: Information disclosure in ajax.render.php

LOW 17

Combodo iTop is a web based IT service management tool.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00276 Published 2026-08-21 Fixed in 3.2.3 CWE-209

TI-2026-25658 CVE-2026-33240

Combodo iTop: Reflected XSS in foreign key search criteria

MEDIUM 40

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00466 Published 2026-08-21 Fixed in 3.2.3 CWE-79

TI-2026-25493 CVE-2026-33047

Combodo iTop: Object can be locked by a user without write permissions

LOW 20

Combodo iTop is a web based IT service management tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00372 Published 2026-08-21 Fixed in 3.2.3 CWE-862

TI-2026-24482 CVE-2026-31936

Combodo iTop: Unauthorized access to object information via search operation

MEDIUM 41

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00481 Published 2026-08-21 Fixed in 3.2.3 CWE-862

TI-2026-24432 CVE-2026-31880

Combodo iTop: Reflected XSS in universal search

LOW 37

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00428 Published 2026-08-21 Fixed in 3.2.3 CWE-79

TI-2026-24358 CVE-2026-31803

Combodo iTop: Reflected XSS in tag admin

LOW 37

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00428 Published 2026-08-21 Fixed in 3.2.3 CWE-79

TI-2026-23719 CVE-2026-30890

Combodo iTop: Reflected XSS in synchro/synchro_import.php

LOW 37

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00428 Published 2026-08-21 Fixed in 3.2.3 CWE-79

TI-2026-23694 CVE-2026-30865

Combodo iTop: Reflected XSS in dashboard save

LOW 31

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00261 Published 2026-08-21 Fixed in 3.2.3 CWE-79

TI-2026-23655 CVE-2026-30826

Combodo iTop: Reflected XSS in run_query.php

LOW 37

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00428 Published 2026-08-21 Fixed in 3.2.3 CWE-79

TI-2026-23648 CVE-2026-30819

Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter

LOW 34

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00367 Published 2026-08-21 Fixed in 3.2.3 CWE-79

TI-2026-21897 CVE-2026-27490

Combodo iTop: Weak secret generation for inline image

LOW 39

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00432 Published 2026-08-21 Fixed in 3.2.3 CWE-330

TI-2026-21870 CVE-2026-27463

Combodo iTop: Version disclosure via login page logo

LOW 30

Combodo iTop is a web based IT service management tool.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00343 Published 2026-08-21 Fixed in 3.2.3 CWE-200

TI-2026-21869 CVE-2026-27462

Combodo iTop: User enumeration via password reset

HIGH 66

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00432 Published 2026-08-21 Fixed in 3.2.3 CWE-204

TI-2026-23695 CVE-2026-30866

Combodo iTop: Insecured access to uploaded images via sniffed url

LOW 39

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00459 Published 2026-08-21 Fixed in 3.2.3 CWE-200

TI-2025-39611 CVE-2025-64167

Combodo iTop vulnerable to reflected XSS in webservices/export.php

LOW 31

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0025 Published 2025-11-10 Fixed in 2.7.13, 3.2.2 CWE-79

TI-2025-31225 CVE-2025-49145

iTop admin can drop iTop database using webhooks

MEDIUM 40

Combodo iTop is a web based IT service management tool.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00322 Published 2025-11-10 Fixed in 2.7.13, 3.2.2 CWE-863

TI-2025-31028 CVE-2025-48878

Combodo iTop vulnerable to IDOR with ModuleInstallation object

LOW 19

Combodo iTop is a web based IT service management tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00211 Published 2025-11-10 Fixed in 3.2.2 CWE-862