Combodo iTop

• CVE-2026-108717 Medium 6.3 Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController 0.3%
• CVE-2026-40877 High 8.7 Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences 0.5%
• CVE-2026-30864 High 8.9 Combodo iTop: Reflected XSS in dashboard revert 0.4%
• CVE-2026-39975 Critical 9.4 Combodo iTop: Remote code execution using external auth variable value 0.6%
• CVE-2026-34949 Medium 6.5 Combodo iTop: Unauthenticated user can delete .readonly file 0.4%
• CVE-2026-34948 High 7.7 Combodo iTop: Access control bypass via OQL joins 0.4%
• CVE-2026-34836 Medium 6.5 Combodo iTop: Improper access control in ajax.render.php and ajax.document.php 0.4%
• CVE-2026-34741 High 8.6 Combodo iTop: Authentication bypass in exec.php allows PHP file execution 0.6%
• CVE-2026-33333 Low 3.5 Combodo iTop: Information disclosure in ajax.render.php 0.3%
• CVE-2026-33240 High 8.8 Combodo iTop: Reflected XSS in foreign key search criteria 0.5%
• CVE-2026-33047 Medium 4.3 Combodo iTop: Object can be locked by a user without write permissions 0.4%
• CVE-2026-31936 High 8.8 Combodo iTop: Unauthorized access to object information via search operation 0.5%
• CVE-2026-31880 High 8.0 Combodo iTop: Reflected XSS in universal search 0.4%
• CVE-2026-31803 High 8.0 Combodo iTop: Reflected XSS in tag admin 0.4%
• CVE-2026-30890 High 8.0 Combodo iTop: Reflected XSS in synchro/synchro_import.php 0.4%
• CVE-2026-30865 High 7.1 Combodo iTop: Reflected XSS in dashboard save 0.3%
• CVE-2026-30826 High 8.0 Combodo iTop: Reflected XSS in run_query.php 0.4%
• CVE-2026-30819 High 7.3 Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter 0.4%
• CVE-2026-27490 High 7.5 Combodo iTop: Weak secret generation for inline image 0.4%
• CVE-2026-27463 Medium 5.3 Combodo iTop: Version disclosure via login page logo 0.3%
• CVE-2026-27462 High 7.5 Combodo iTop: User enumeration via password reset 0.4%
• CVE-2026-30866 High 7.5 Combodo iTop: Insecured access to uploaded images via sniffed url 0.5%
• CVE-2025-64167 High 7.1 Combodo iTop vulnerable to reflected XSS in webservices/export.php 0.2%
• CVE-2025-49145 High 8.7 iTop admin can drop iTop database using webhooks 0.3%
• CVE-2025-48878 Medium 4.3 Combodo iTop vulnerable to IDOR with ModuleInstallation object 0.2%
• CVE-2025-48065 High 8.8 Combodo iTop vulnerable to reflected XSS via objection edition form error 0.2%
• CVE-2025-48055 High 8.5 Combodo iTop has stored XSS in user portal's browse brick 0.2%
• CVE-2025-47932 High 8.8 Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard 0.2%
• CVE-2025-47773 High 8.8 Combodo iTop has XSS vulnerability in /pages/ajax.render.php 0.2%
• CVE-2025-47286 High 8.6 Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality 0.5%
• CVE-2025-24969 Medium 5.0 iTop portal user can see any other contact's picture 0.3%
• CVE-2025-24785 Medium 4.3 iTop dashboard vulnerable to denial of service 0.3%
• CVE-2025-24026 Medium 5.3 iTop Inefficient Regular Expression Complexity vulnerability 0.3%
• CVE-2025-24022 High 8.6 iTop server vulnerable to portal code injection 0.7%
• CVE-2025-24021 Medium 5.0 iTop doesn't have mass assignment of fields in the portal form 0.3%
• CVE-2024-56157 Medium 6.3 iTop vulnerable to Self XSS in CSV Import 0.3%
• CVE-2024-52601 Medium 6.5 iTop portal Insecure Direct Object Reference vulnerability 0.3%
• CVE-2025-27139 Medium 6.8 Combodo iTop vulnerable to stored self Cross-site Scripting in preferences 0.2%
• CVE-2024-54139 High 7.9 Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter 0.2%
• CVE-2024-52000 High 8.1 Reflected Cross-site Scripting exploit in Combodo iTop 0.4%
• CVE-2024-52001 Medium 4.3 Portal user is able to access forbidden services information in Combodo iTop 0.3%
• CVE-2024-52002 High 7.6 Cross-Site Request Forgery (CSRF) in several iTop pages 0.7%
• CVE-2024-51993 Low 3.4 Password is stored in clear in the database in Combodo iTop 0.1%
• CVE-2024-51994 High 7.1 Cross-site Scripting in portal picture upload in Combodo iTop 0.4%
• CVE-2024-51995 High 7.1 Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop 0.4%
• CVE-2024-51740 Medium 4.3 SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop 0.5%
• CVE-2024-51739 High 7.5 Users enumeration allowed through Rest API in Combodo iTop 1.2%
• CVE-2024-32870 Medium 5.8 iTop hub connector Information disclosure 0.8%
• CVE-2024-31998 High 8.8 CSRF security issue on CSV import in Combodo iTop 0.2%
• CVE-2024-31448 High 8.8 Cross-site Scripting vulnerability in link CSV import in Combodo iTop 0.4%