CVE-2024-51993

CVE-2024-51993 affects Combodo iTop (pre-3.2.0) where passwords for misconfigured users are stored in cleartext and can be read if an attacker gains access to backups or the database. The issue is mitigated by upgrading to version 3.2.0 or later. If upgrading is not possible, encryption of backup...

CVE-2020-12779

CVE-2020-12779 concerns a stored XSS in Combodo iTop via uploading a file containing malicious script. The connected advisories corroborate repeated iTop XSS issues across multiple versions and components (e.g., UI and dashboard-related paths) with affected versions including pre-3.0.4, pre-3.1.1...

CVE-2020-12780

CVE-2020-12780 stems from a security misconfiguration in Combodo iTop exposing sensitive information. Connected advisories describe related, concrete iTop flaws affecting multiple versions and modules: XSS in dashlets/dashboard editor (pre-3.0.4/3.1.1), full path disclosure in dashboard config, a...

CVE-2021-21406

CVE-2021-21406 affects Combodo iTop, a web-based IT service management tool. In versions before 2.7.4, there is a command injection vulnerability in the Setup Wizard triggered by providing the Graphviz executable path. Root cause is input handling in the setup flow that allows executing system co...

CVE-2023-43790

CVE-2023-43790 (iTop) is an XSS vulnerability affecting iTop where an attacker can inject malicious content by manipulating HTTP queries in fields used for the object’s friendlyname. The issue is fixed in versions 3.1.1 and 3.2.0. Affected product: Combodo iTop (IT service management platform). R...

CVE-2024-51994

Affected software: Combodo iTop (web-based IT Service Management). Vulnerability: Cross-site Scripting (XSS) triggered by uploading a text file containing JavaScript in the portal. Root cause / details: The issue exists in versions prior to 3.2.0; uploading a crafted text file enables script exec...

CVE-2024-51995

Combodo iTop is affected by a logic bug in ajax.render.php that allows bypassing backOffice access control by crafting arbitrary routes, unless an allowed operation is specified. The issue is resolved in version 3.2.0 by applying the same access-control pattern used in UI.php to ajax.render.php, ...

CVE-2021-32664

CVE-2021-32664 (Combodo iTop) is an XSS vulnerability on the run query page when authenticated as administrator. The primary description notes affected versions and fixes: it was resolved in iTop versions 2.6.5 and 2.7.5. Connected sources corroborate iTop-specific issues and mitigations across m...

CVE-2022-39216

CVE-2022-39216 affects Combodo iTop. Before versions 2.7.8 and 3.0.2-1, the reset password token is generated without any randomness parameter, which may lead to account takeover. The issue is fixed in versions 2.7.8 and 3.0.2-1. Vectors/exploitation details beyond this are not provided in the ac...

CVE-2023-44396

CVE-2023-44396 affects Combodo iTop, where dashlet edits via ajax endpoints can be exploited to trigger cross-site scripting (XSS). The issue is fixed in iTop releases 2.7.10, 3.0.4, and 3.1.1; affected are prior builds of those lines. Root cause: unsanitized or improperly handled input in dashle...

CVE-2024-52000

CVE-2024-52000 affects Combodo iTop (prior to version 3.2.0): a reflected Cross-site Scripting (XSS) vulnerability triggered by editing a request payload, potentially enabling malicious JavaScript execution. The issue is mitigated in version 3.2.0 via systematic escaping of error messages when re...

CVE-2024-52601

CVE-2024-52601 – iTop portal exposure is a read-access flaw in the web-based IT Service Management tool iTop. Prior to versions 2.7.12, 3.1.3, and 3.2.1, accounts with portal access could read objects they are not permitted to see by querying an unprotected route (Insecure Direct Object Reference...

CVE-2025-24026

CVE-2025-24026 concerns iTop, a web-based ITSM tool. Versions prior to 3.2.1 are vulnerable to a regular expression denial of service (ReDoS) that may affect the iTop server under certain circumstances; the issue stems from using an affected variable in a regex. Version 3.2.1 does not use the vul...

CVE-2020-15219

Combodo iTop vulnerable component: when a download error occurs in the user portal, an SQL query is exposed to the user. Root cause: error path reveals internal SQL. Affected versions: iTop before 2.7.2 and before 3.0.0. Impact per sources: potential information disclosure of the query; no exploi...

CVE-2023-47489

Combodo iTop vulnerable to CSV injection in export as CSV (export-v2.php and ajax.render.php) for version 3.1.0-2-11973. A crafted CSV export script can allow a local attacker to execute arbitrary code. Root cause is described as CSV injection via the export pipeline; some sources also cite a rel...

CVE-2024-52001

CVE-2024-52001 affects Combodo iTop, a web-based IT Service Management tool. The issue allows portal users to access information about prohibited/forbidden services in affected releases. Public sources consistently state upgrades address the vulnerability, with remediation to version 3.2.0 or lat...

CVE-2023-34446

CVE-2023-34446 concerns an XSS vulnerability in iTop, a web-based IT service management platform. The issue occurs prior to versions 3.0.4 and 3.1.0 when rendering pages/preferences.php, allowing cross-site scripting. The vulnerability is fixed in 3.0.4 and 3.1.0. Affected software: iTop (open so...

CVE-2020-4079

CVE-2020-4079 affects Combodo iTop prior to 2.7.2 and 2.8.0 where the ajax endpoint for the Excel export portal could be accessed directly, bypassing scope filtering and exposing data to users who should not have access. Root cause: missing access control on the Excel export data retrieval. Impac...

CVE-2013-0805

CVE-2013-0805 covers multiple cross-site scripting (XSS) flaws in the iTop (IT Operations Portal) search feature. The vulnerabilities allow remote attackers to inject arbitrary HTML/script via the text parameter to pages/UI.php or the expression parameter to pages/run_query.php. Affected versions...

CVE-2020-15221

CVE-2020-15221 : Combodo iTop (web ITSM) is vulnerable to a cross-site scripting (XSS) flaw introduced by manipulating the target browser localStorage, affecting iTop versions prior to 2.7.2 and 3.0.0. The issue is fixed in 2.7.2 and 3.0.0. No exploitation details are provided in the given docume...

CVE-2023-47488

CVE-2023-47488 affects Combodo iTop 3.1.0-2-11973, where a Cross Site Scripting vulnerability exists in the General Information and contact pages via crafted input to attrib_manager_id and id parameters. The issue could let a local attacker obtain sensitive information. Public references include ...

CVE-2020-15220

CVE-2020-15220 affects Combodo iTop (open-source IT Service Management platform). In iTop versions prior to 2.7.2 and 3.0.0, two cookies are created for the same session, enabling potential session hijacking. The issue is fixed in version 2.7.2 and in version 3.0.0. Connected sources corroborate ...

CVE-2025-49145

Combodo iTop vulnerability CVE-2025-49145 affects iTop versions prior to 2.7.13 and 3.2.2. A user with sufficient rights to create webhooks (typically administrators) can trigger database deletion due to unverified callback signatures. The issue is mitigated in iTop by upgrading to 2.7.13 or 3.2....

CVE-2020-15218

Combodo iTop is affected prior to versions 2.7.2 and 3.0.0 where admin pages are cached, allowing content to be visible after a user navigates back. This is fixed in 2.7.2 and 3.0.0. The provided data indicates partial confidentiality impact with a MEDIUM/LOW severity depending on vector, and no ...

CVE-2025-47286

Combodo iTop is affected by CVE-2025-47286 in versions prior to 2.7.13 and 3.2.2, where an administrator can execute server code by editing the iTop configuration. Versions 2.7.13 and 3.2.2 introduce checks/escaping of the config parameter before command execution. Affected component: iTop config...

CVE-2025-48878

CVE-2025-48878 affects Combodo iTop (3.x) prior to 3.2.2. The vulnerability is an insecure direct object reference that allows a user (e.g., with a Service desk agent profile) to create a ModuleInstallation object when they should not be able to. The issue is resolved in 3.2.2. Impact details are...

CVE-2025-48055

The CVE-2025-48055 entry concerns Combodo iTop, a web-based IT service management tool. Concrete details across connected sources show a stored XSS vulnerability in the user portal’s browse brick, affecting versions prior to 3.2.2. The root cause is improper handling/display of content in the bro...

CVE-2025-48065

CVE-2025-48065 affects Combodo iTop (web-based ITSM). Affected versions: before 2.7.13 and before 3.2.2 are vulnerable to cross-site scripting when an error field contains malicious content; versions 2.7.13 and 3.2.2 are protected from this. Root cause concerns reflected XSS via error-field rende...

CVE-2025-47773

Combodo iTop is affected by a cross-site scripting (XSS) vulnerability in the dashboard editing functionality invoked via AJAX calls. The issue affects versions prior to 2.7.13 and prior to 3.2.2; versions 2.7.13 and 3.2.2 are reported to protect rendered HTML content. The root cause is an XSS fl...

CVE-2025-64167

Combodo iTop, a web-based IT service management tool, is vulnerable to cross-site scripting (JS execution) in versions prior to 2.7.13 and 3.2.2 when editing a URL parameter. In these versions, the export.php endpoint was deprecated and export-v2.php is used instead; the issue stems from insuffic...

CVE-2025-47932

Combodo iTop (web-based IT service management) is affected. Affected versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when rendering dashboards via AJAX. Root cause: insufficient sanitization of the variable used during the dashboard render. The issue is addressed in vers...