CVE-2026-30864

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting XSS in the dashboard revert functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30864 Combodo iTop: Reflected XSS in dashboard revert

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting XSS in the dashboard revert functionality. This issue has been fixed in version 3.2.3...

CVE-2026-39975 Combodo iTop: Remote code execution using external auth variable value

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in versi...

CVE-2026-34948

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

EUVD-2026-64189

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3...

CVE-2026-34949 Combodo iTop: Unauthenticated user can delete .readonly file

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3...

CVE-2026-34949

Combodo iTop versions prior to 3.2.3 are affected by an unauthenticated file deletion vulnerability. An attacker with no credentials can delete the .readonly file, which is created during the setup process to prevent users from performing write actions. Removing this file effectively disables the...

CVE-2026-34948

Combodo iTop versions prior to 3.2.3 are affected by an access control bypass in its OQL (Object Query Language) engine. The root cause is that the silos access check only applies to classes present in the SELECT clause , leaving classes referenced via JOINs unprotected. This allows an authentica...

EUVD-2026-64187

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-34948 Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-34948 Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-33333

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3...

CVE-2026-34836

Combodo iTop versions prior to 3.2.3 contain an improper access control vulnerability in ajax.render.php and ajax.document.php. The flaw allows authenticated users to access documents without proper permission checks, resulting in high confidentiality impact (CVSS 3.1: 6.5 MEDIUM ). The attack re...

EUVD-2026-64184

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3...

CVE-2026-34836 Combodo iTop: Improper access control in ajax.render.php and ajax.document.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3...

CVE-2026-34741

Combodo iTop (web-based IT service management tool) is affected by an authentication bypass in exec.php that allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. The vulnerability is rated CV...

CVE-2026-34741 Combodo iTop: Authentication bypass in exec.php allows PHP file execution

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

EUVD-2026-64183

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

CVE-2026-33333

Combodo iTop , a web-based IT service management tool, is affected by a sensitive information disclosure vulnerability in the ajax.render.php component prior to version 3.2.3 . Error messages expose sensitive information to authenticated users. The CVSS 3.1 score is 3.5 (LOW) , reflecting low con...

EUVD-2026-64182

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3...