CVE-2025-64167 | High | 7.1 | 2025-11-10 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack (leading to JS execu… |
CVE-2025-49145 | High | 8.7 | 2025-11-10 | Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly adminis… |
CVE-2025-48878 | Medium | 4.3 | 2025-11-10 | Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. w… |
CVE-2025-48065 | High | 8.8 | 2025-11-10 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error co… |
CVE-2025-48055 | High | 8.5 | 2025-11-10 | Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site… |
CVE-2025-47932 | High | 8.8 | 2025-11-10 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is rendered… |
CVE-2025-47773 | High | 8.8 | 2025-11-10 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited vi… |
CVE-2025-47286 | High | 7.2 | 2025-11-10 | Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop i… |
CVE-2025-24969 | Medium | 5.0 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any other contacts picture by changing the picture ID in the URL… |
CVE-2025-24785 | Medium | 4.3 | 2025-05-14 | iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the server to trigger a PHP error. The next user trying to loa… |
CVE-2025-24026 | Medium | 5.3 | 2025-05-14 | iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some ci… |
CVE-2025-24022 | High | 8.5 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's p… |
CVE-2025-24021 | Medium | 5.0 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to objec… |
CVE-2024-56157 | Medium | 6.3 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack c… |
CVE-2024-52601 | Medium | 6.5 | 2025-05-14 | iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access t… |
CVE-2025-27139 | Medium | 6.8 | 2025-02-25 | Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting when the preferences… |
CVE-2024-54139 | High | 7.9 | 2024-12-13 | Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulne… |
CVE-2024-52002 | High | 8.8 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please… |
CVE-2024-52001 | Medium | 4.3 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue… |
CVE-2024-52000 | Medium | 6.1 | 2024-11-08 | Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editi… |
CVE-2024-51995 | High | 7.1 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This… |
CVE-2024-51994 | Medium | 5.4 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cr… |
CVE-2024-51993 | Low | 3.4 | 2024-11-07 | Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. Th… |
CVE-2024-51740 | Medium | 4.3 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low priv… |
CVE-2024-51739 | High | 7.5 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a va… |
CVE-2024-32870 | Medium | 5.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone havin… |
CVE-2024-31998 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 a… |
CVE-2024-31448 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be perform… |
CVE-2023-34445 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.php XSS are possible for scripts outside of script tags. This… |
CVE-2023-34444 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags… |
CVE-2023-34443 | High | 8.8 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of… |
CVE-2023-48710 | Critical | 9.8 | 2024-04-15 | iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully… |
CVE-2023-48709 | High | 8.0 | 2024-04-15 | iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas t… |
CVE-2023-47626 | High | 8.8 | 2024-04-15 | iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1. |
CVE-2023-47622 | High | 8.8 | 2024-04-15 | iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1. |
CVE-2023-47123 | High | 8.7 | 2024-04-15 | iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this… |
CVE-2023-45808 | Medium | 4.1 | 2024-04-15 | iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, b… |
CVE-2023-44396 | Medium | 6.8 | 2024-04-15 | iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.
|
CVE-2023-43790 | Medium | 5.7 | 2024-04-15 | iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname va… |
CVE-2023-38511 | Medium | 5.0 | 2024-04-15 | iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnera… |
CVE-2023-47489 | High | 7.8 | 2023-11-09 | CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and… |
CVE-2023-47488 | Medium | 6.1 | 2023-11-09 | Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attrib_m… |
CVE-2023-34447 | High | 8.8 | 2023-10-25 | iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This… |
CVE-2023-34446 | High | 8.8 | 2023-10-25 | iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site script… |
CVE-2022-39216 | High | 7.4 | 2023-03-14 | Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without an… |
CVE-2022-39214 | Critical | 9.6 | 2023-03-14 | Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take ov… |
CVE-2022-31403 | Medium | 6.1 | 2022-06-14 | ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php. |
CVE-2022-31402 | Medium | 6.1 | 2022-06-10 | ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php. |
CVE-2022-24870 | High | 8.7 | 2022-04-21 | Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop c… |
CVE-2021-41162 | Critical | 9.3 | 2022-04-21 | Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not proper… |
CVE-2021-41161 | Critical | 9.3 | 2022-04-21 | Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters… |
CVE-2022-24811 | Medium | 5.4 | 2022-04-05 | Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags… |
CVE-2022-24780 | High | 8.8 | 2022-04-05 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by… |
CVE-2021-41245 | Medium | 6.5 | 2022-04-05 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly… |
CVE-2021-32664 | High | 8.1 | 2021-10-19 | Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as admin… |
CVE-2021-32663 | High | 8.7 | 2021-10-19 | iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific… |
CVE-2021-32776 | Medium | 6.8 | 2021-07-21 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cle… |
CVE-2021-32775 | High | 7.7 | 2021-07-21 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy… |
CVE-2021-21407 | High | 8.0 | 2021-07-21 | Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed through iTop portal via… |
CVE-2021-21406 | Medium | 5.8 | 2021-07-21 | Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizar… |
CVE-2020-15221 | Medium | 6.8 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be gener… |
CVE-2020-15220 | Medium | 6.1 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a… |
CVE-2020-15219 | Medium | 4.3 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL… |
CVE-2020-15218 | Medium | 6.8 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after… |
CVE-2020-4079 | High | 7.7 | 2021-01-12 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functiona… |
CVE-2020-12781 | Medium | 5.7 | 2020-08-10 | Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery. |
CVE-2020-12780 | High | 7.5 | 2020-08-10 | A security misconfiguration exists in Combodo iTop, which can expose sensitive information. |
CVE-2020-12779 | Medium | 6.8 | 2020-08-10 | Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script. |
CVE-2020-12778 | High | 7.4 | 2020-08-10 | Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack. |
CVE-2020-12777 | High | 7.5 | 2020-08-10 | A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system informat… |
CVE-2020-11696 | Medium | 6.1 | 2020-06-05 | In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in ver… |
CVE-2020-11697 | Medium | 6.1 | 2020-06-05 | In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for vers… |
CVE-2019-19821 | High | 8.1 | 2020-03-16 | A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify informati… |
CVE-2019-13967 | High | 7.5 | 2020-02-14 | iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The request… |
CVE-2019-13966 | Medium | 6.1 | 2020-02-14 | In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-201… |
CVE-2019-13965 | Medium | 6.1 | 2020-02-14 | Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices… |
CVE-2019-11215 | High | 8.1 | 2020-02-14 | In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader wit… |
CVE-2019-10863 | High | 7.2 | 2019-04-04 | A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows one to create a new PHP file with the exc… |
CVE-2018-10642 | High | 7.2 | 2018-05-02 | Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configu… |
CVE-2015-6544 | Medium | 6.1 | 2018-02-20 | Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary w… |
CVE-2013-0805 | | | 2014-03-20 | Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attacker… |
CVE-2011-4275 | | | 2011-11-26 | Multiple cross-site scripting (XSS) vulnerabilities in iTop (aka IT Operations Portal) 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web… |