Combodo Itop vulnerabilities

• combodo itop Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController CVE-2026-108717 5.3 MediumOctober 11, 2026
• combodo itop Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences CVE-2026-40877 8.7 HighAugust 24, 2026
• combodo itop Combodo iTop: Reflected XSS in dashboard revert CVE-2026-30864 8.9 HighAugust 24, 2026
• combodo itop Combodo iTop: Remote code execution using external auth variable value CVE-2026-39975 9.4 CriticalAugust 24, 2026
• combodo itop Combodo iTop: Unauthenticated user can delete .readonly file CVE-2026-34949 6.5 MediumAugust 21, 2026
• combodo itop Combodo iTop: Access control bypass via OQL joins CVE-2026-34948 7.7 HighAugust 21, 2026
• combodo itop Combodo iTop: Improper access control in ajax.render.php and ajax.document.php CVE-2026-34836 6.5 MediumAugust 21, 2026
• combodo itop Combodo iTop: Authentication bypass in exec.php allows PHP file execution CVE-2026-34741 8.6 HighAugust 21, 2026
• combodo itop Combodo iTop: Information disclosure in ajax.render.php CVE-2026-33333 3.5 LowAugust 21, 2026
• combodo itop Combodo iTop: Reflected XSS in foreign key search criteria CVE-2026-33240 8.8 HighAugust 21, 2026
• combodo itop Combodo iTop: Object can be locked by a user without write permissions CVE-2026-33047 4.3 MediumAugust 21, 2026
• combodo itop Combodo iTop: Unauthorized access to object information via search operation CVE-2026-31936 8.8 HighAugust 21, 2026
• combodo itop Combodo iTop: Reflected XSS in universal search CVE-2026-31880 8.0 HighAugust 21, 2026
• combodo itop Combodo iTop: Reflected XSS in tag admin CVE-2026-31803 8.0 HighAugust 21, 2026
• combodo itop Combodo iTop: Reflected XSS in synchro/synchro_import.php CVE-2026-30890 8.0 HighAugust 21, 2026
• combodo itop Combodo iTop: Reflected XSS in dashboard save CVE-2026-30865 7.1 HighAugust 21, 2026
• combodo itop Combodo iTop: Reflected XSS in run_query.php CVE-2026-30826 8.0 HighAugust 21, 2026
• combodo itop Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter CVE-2026-30819 7.3 HighAugust 21, 2026
• combodo itop Combodo iTop: Weak secret generation for inline image CVE-2026-27490 7.5 HighAugust 21, 2026
• combodo itop Combodo iTop: Version disclosure via login page logo CVE-2026-27463 5.3 MediumAugust 21, 2026
• combodo itop Combodo iTop: User enumeration via password reset CVE-2026-27462 7.5 HighAugust 21, 2026
• combodo itop Combodo iTop: Insecured access to uploaded images via sniffed url CVE-2026-30866 7.5 HighAugust 21, 2026
• combodo itop Combodo iTop vulnerable to reflected XSS in webservices/export.php CVE-2025-64167 7.1 HighNovember 10, 2025
• combodo itop iTop admin can drop iTop database using webhooks CVE-2025-49145 8.7 HighNovember 10, 2025
• combodo itop Combodo iTop vulnerable to IDOR with ModuleInstallation object CVE-2025-48878 4.3 MediumNovember 10, 2025
• combodo itop Combodo iTop vulnerable to reflected XSS via objection edition form error CVE-2025-48065 8.8 HighNovember 10, 2025
• combodo itop Combodo iTop has stored XSS in user portal's browse brick CVE-2025-48055 8.5 HighNovember 10, 2025
• combodo itop Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard CVE-2025-47932 8.8 HighNovember 10, 2025
• combodo itop Combodo iTop has XSS vulnerability in /pages/ajax.render.php CVE-2025-47773 8.8 HighNovember 10, 2025
• combodo itop Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality CVE-2025-47286 8.6 HighNovember 10, 2025
• combodo itop iTop portal user can see any other contact's picture CVE-2025-24969 5.0 MediumMay 14, 2025
• combodo itop iTop dashboard vulnerable to denial of service CVE-2025-24785 4.3 MediumMay 14, 2025
• combodo itop iTop Inefficient Regular Expression Complexity vulnerability CVE-2025-24026 5.3 MediumMay 14, 2025
• combodo itop iTop server vulnerable to portal code injection CVE-2025-24022 8.6 HighMay 14, 2025
• combodo itop iTop doesn't have mass assignment of fields in the portal form CVE-2025-24021 5.0 MediumMay 14, 2025
• combodo itop iTop vulnerable to Self XSS in CSV Import CVE-2024-56157 6.3 MediumMay 14, 2025
• combodo itop iTop portal Insecure Direct Object Reference vulnerability CVE-2024-52601 6.5 MediumMay 14, 2025
• combodo itop Combodo iTop vulnerable to stored self Cross-site Scripting in preferences CVE-2025-27139 6.8 MediumFebruary 25, 2025
• combodo itop Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter CVE-2024-54139 7.9 HighDecember 13, 2024
• combodo itop Reflected Cross-site Scripting exploit in Combodo iTop CVE-2024-52000 8.1 HighNovember 8, 2024
• combodo itop Portal user is able to access forbidden services information in Combodo iTop CVE-2024-52001 4.3 MediumNovember 8, 2024
• combodo itop Cross-Site Request Forgery (CSRF) in several iTop pages CVE-2024-52002 Public exploit 7.6 HighNovember 8, 2024
• combodo itop Password is stored in clear in the database in Combodo iTop CVE-2024-51993 3.4 LowNovember 7, 2024
• combodo itop Cross-site Scripting in portal picture upload in Combodo iTop CVE-2024-51994 7.1 HighNovember 7, 2024
• combodo itop Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop CVE-2024-51995 7.1 HighNovember 7, 2024
• combodo itop SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop CVE-2024-51740 4.3 MediumNovember 5, 2024
• combodo itop Users enumeration allowed through Rest API in Combodo iTop CVE-2024-51739 7.5 HighNovember 5, 2024
• combodo itop iTop hub connector Information disclosure CVE-2024-32870 5.8 MediumNovember 4, 2024
• combodo itop CSRF security issue on CSV import in Combodo iTop CVE-2024-31998 8.8 HighNovember 4, 2024
• combodo itop Cross-site Scripting vulnerability in link CSV import in Combodo iTop CVE-2024-31448 8.8 HighNovember 4, 2024
• Show olderLoading…