EUVD-2026-82469

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54596

ITFlow , an IT documentation, ticketing, and accounting platform for managed service providers, is affected by an authenticated SQL injection in its recurring invoice endpoint (agent/post/recurring_invoice.php). The recurring_invoice_frequency parameter passes through sanitizeInput but is interpo...

CVE-2026-54596

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54596: Improper Neutralization of Special Elements used in an SQL Command

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54597: Improper Neutralization of Special Elements used in an SQL Command

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

PT-2026-95104

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07 Description An authenticated user with Technician privileges or higher who has access to at least one client invoice can perform SQL injection. The issue occurs at the 'agent/post/recurring invoice.php' endpoint...

ITFlow Unfinished Installation Detection

Detected ITFlow setup wizard was exposed with an unfinished installation, allowing attackers to configure the database and create an admin account. !/usr/bin/env python3 -- coding: utf-8 -- """Detected ITFlow setup wizard was exposed with an unfinished installation, allowing attackers to configur...

CVE-2026-47755

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal wit...

CVE-2026-47755 ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal wit...

CVE-2026-47755 ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal wit...

CVE-2026-47755

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal wit...

CVE-2026-47755: Authorization Bypass Through User-Controlled Key

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal wit...

PT-2026-49626

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07 Description An authenticated user with module support write permission and access to a credential record can perform time-based blind SQL injection. This occurs because the expires parameter of the share generate...

Exploit for CVE-2026-54597

CVE-2026-54597 — ITFlow Time-Based Blind SQL Injection Seve...

ITFlow security vulnerabilities

ITFlow is an open-source IT documentation, ticket management, and billing ERP software developed by ITFlow. Versions of ITFlow prior to 10.0.0 contained security vulnerabilities. These vulnerabilities stemmed from insufficient validation of action parameters in the flow/admin/moniteur.php script,...

CVE-2025-67081

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "roleid" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises fro...

CVE-2025-67081

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "roleid" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises fro...

CVE-2025-67081

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "roleid" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises fro...

CVE-2025-67081

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "roleid" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises fro...

PT-2026-3025

Name of the Vulnerable Software and Affected Versions Itflow versions through 25.06 Description An SQL injection issue exists in Itflow due to insufficient sanitization of integer parameters. Specifically, the "role id" parameter is vulnerable when editing a profile. An attacker with administrati...