What’s Vulnerable › Products

Combodo iTop vulnerabilities

103 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 53 published in the last 12 months.

Check whether your Combodo iTop version is affected

Latest Combodo iTop vulnerabilities

• CVE-2026-108717 — Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController (CVSS 6.3)
• CVE-2026-40877 — Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences (CVSS 8.7)
• CVE-2026-39975 — Combodo iTop: Remote code execution using external auth variable value (CVSS 9.4)
• CVE-2026-30864 — Combodo iTop: Reflected XSS in dashboard revert (CVSS 8.9)
• CVE-2026-34949 — Combodo iTop: Unauthenticated user can delete .readonly file (CVSS 6.5)
• CVE-2026-34948 — Combodo iTop: Access control bypass via OQL joins (CVSS 7.7)
• CVE-2026-34836 — Combodo iTop: Improper access control in ajax.render.php and ajax.document.php (CVSS 6.5)
• CVE-2026-34741 — Combodo iTop: Authentication bypass in exec.php allows PHP file execution (CVSS 8.6)
• CVE-2026-33333 — Combodo iTop: Information disclosure in ajax.render.php (CVSS 3.5)
• CVE-2026-33240 — Combodo iTop: Reflected XSS in foreign key search criteria (CVSS 8.8)
• CVE-2026-33047 — Combodo iTop: Object can be locked by a user without write permissions (CVSS 4.3)
• CVE-2026-31936 — Combodo iTop: Unauthorized access to object information via search operation (CVSS 8.8)
• CVE-2026-31880 — Combodo iTop: Reflected XSS in universal search (CVSS 8.0)
• CVE-2026-31803 — Combodo iTop: Reflected XSS in tag admin (CVSS 8.0)
• CVE-2026-30890 — Combodo iTop: Reflected XSS in synchro/synchro_import.php (CVSS 8.0)
• CVE-2026-30865 — Combodo iTop: Reflected XSS in dashboard save (CVSS 7.1)
• CVE-2026-30826 — Combodo iTop: Reflected XSS in run_query.php (CVSS 8.0)
• CVE-2026-30866 — Combodo iTop: Insecured access to uploaded images via sniffed url (CVSS 7.5)
• CVE-2026-30819 — Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter (CVSS 7.3)
• CVE-2026-27490 — Combodo iTop: Weak secret generation for inline image (CVSS 7.5)
• CVE-2026-27463 — Combodo iTop: Version disclosure via login page logo (CVSS 5.3)
• CVE-2026-27462 — Combodo iTop: User enumeration via password reset (CVSS 7.5)
• CVE-2025-64167 — Combodo iTop vulnerable to reflected XSS in webservices/export.php (CVSS 6.1)
• CVE-2025-49145 — iTop admin can drop iTop database using webhooks (CVSS 6.5)
• CVE-2025-48878 — Combodo iTop vulnerable to IDOR with ModuleInstallation object (CVSS 4.3)