Combodo / iTop
87 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-40877 | Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences | HIGH | 8.7 | Aug 24, 2026 |
| CVE-2026-30864 | Combodo iTop: Reflected XSS in dashboard revert | HIGH | 8.9 | Aug 24, 2026 |
| CVE-2026-39975 | Combodo iTop: Remote code execution using external auth variable value | CRITICAL | 9.4 | Aug 24, 2026 |
| CVE-2026-34949 | Combodo iTop: Unauthenticated user can delete .readonly file | MEDIUM | 6.5 | Aug 21, 2026 |
| CVE-2026-34948 | Combodo iTop: Access control bypass via OQL joins | HIGH | 7.7 | Aug 21, 2026 |
| CVE-2026-34836 | Combodo iTop: Improper access control in ajax.render.php and ajax.document.php | MEDIUM | 6.5 | Aug 21, 2026 |
| CVE-2026-34741 | Combodo iTop: Authentication bypass in exec.php allows PHP file execution | HIGH | 8.6 | Aug 21, 2026 |
| CVE-2026-33333 | Combodo iTop: Information disclosure in ajax.render.php | LOW | 3.5 | Aug 21, 2026 |
| CVE-2026-33240 | Combodo iTop: Reflected XSS in foreign key search criteria | HIGH | 8.8 | Aug 21, 2026 |
| CVE-2026-33047 | Combodo iTop: Object can be locked by a user without write permissions | MEDIUM | 4.3 | Aug 21, 2026 |
| CVE-2026-31936 | Combodo iTop: Unauthorized access to object information via search operation | HIGH | 8.8 | Aug 21, 2026 |
| CVE-2026-31880 | Combodo iTop: Reflected XSS in universal search | HIGH | 8.0 | Aug 21, 2026 |
| CVE-2026-31803 | Combodo iTop: Reflected XSS in tag admin | HIGH | 8.0 | Aug 21, 2026 |
| CVE-2026-30890 | Combodo iTop: Reflected XSS in synchro/synchro_import.php | HIGH | 8.0 | Aug 21, 2026 |
| CVE-2026-30865 | Combodo iTop: Reflected XSS in dashboard save | HIGH | 7.1 | Aug 21, 2026 |
| CVE-2026-30826 | Combodo iTop: Reflected XSS in run_query.php | HIGH | 8.0 | Aug 21, 2026 |
| CVE-2026-30819 | Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter | HIGH | 7.3 | Aug 21, 2026 |
| CVE-2026-27490 | Combodo iTop: Weak secret generation for inline image | HIGH | 7.5 | Aug 21, 2026 |
| CVE-2026-27463 | Combodo iTop: Version disclosure via login page logo | MEDIUM | 5.3 | Aug 21, 2026 |
| CVE-2026-27462 | Combodo iTop: User enumeration via password reset | HIGH | 7.5 | Aug 21, 2026 |
| CVE-2026-30866 | Combodo iTop: Insecured access to uploaded images via sniffed url | HIGH | 7.5 | Aug 21, 2026 |
| CVE-2025-64167 | Combodo iTop vulnerable to reflected XSS in webservices/export.php | HIGH | 7.1 | Nov 10, 2025 |
| CVE-2025-49145 | iTop admin can drop iTop database using webhooks | HIGH | 8.7 | Nov 10, 2025 |
| CVE-2025-48878 | Combodo iTop vulnerable to IDOR with ModuleInstallation object | MEDIUM | 4.3 | Nov 10, 2025 |
| CVE-2025-48065 | Combodo iTop vulnerable to reflected XSS via objection edition form error | HIGH | 8.8 | Nov 10, 2025 |
Showing 1 to 25 of 87 CVEs