Skip to content

Product

Combodo iTop vulnerabilities

103 published CVES affecting Combodo iTop, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
103
Critical
4
High
37
Medium
60
Low
2
Unscored
0
CISA KEV
0

Latest Combodo iTop CVEs

Newest publication first · page 1 of 5

  3. CVE-2026-30864 Combodo iTop: Reflected XSS in dashboard revert

    Published
    HighCVSS 8.9 EPSS 0.35%

    Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.

  5. CVE-2026-34949 Combodo iTop: Unauthenticated user can delete .readonly file

    Published
    MediumCVSS 6.5 EPSS 0.37%

    Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3...

  14. CVE-2026-31803 Combodo iTop: Reflected XSS in tag admin

    Published
    HighCVSS 8.0 EPSS 0.43%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

  16. CVE-2026-30865 Combodo iTop: Reflected XSS in dashboard save

    Published
    HighCVSS 7.1 EPSS 0.26%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

  17. CVE-2026-30826 Combodo iTop: Reflected XSS in run_query.php

    Published
    HighCVSS 8.0 EPSS 0.43%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

  21. CVE-2026-27462 Combodo iTop: User enumeration via password reset

    Published
    HighCVSS 7.5 EPSS 0.43%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.

  23. CVE-2025-64167 Combodo iTop vulnerable to reflected XSS in webservices/export.php

    Published
    MediumCVSS 6.1 EPSS 0.25%

    Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack (leading to JS execution) when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use expo...

  24. CVE-2025-49145 iTop admin can drop iTop database using webhooks

    Published
    MediumCVSS 6.5 EPSS 0.32%

    Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.

  25. CVE-2025-48878 Combodo iTop vulnerable to IDOR with ModuleInstallation object

    Published
    MediumCVSS 4.3 EPSS 0.21%

    Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. with Service desk agent profile) to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.