Combodo vulnerabilities
88 CVEs and advisories name Combodo as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-108717Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController
- CVE-2026-40877Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences
- CVE-2026-30864Combodo iTop: Reflected XSS in dashboard revert
- CVE-2026-39975Combodo iTop: Remote code execution using external auth variable value
- CVE-2026-34949Combodo iTop: Unauthenticated user can delete .readonly file
- CVE-2026-34948Combodo iTop: Access control bypass via OQL joins
- CVE-2026-34836Combodo iTop: Improper access control in ajax.render.php and ajax.document.php
- CVE-2026-34741Combodo iTop: Authentication bypass in exec.php allows PHP file execution
- CVE-2026-33333Combodo iTop: Information disclosure in ajax.render.php
- CVE-2026-33240Combodo iTop: Reflected XSS in foreign key search criteria
- CVE-2026-33047Combodo iTop: Object can be locked by a user without write permissions
- CVE-2026-31936Combodo iTop: Unauthorized access to object information via search operation
- CVE-2026-31880Combodo iTop: Reflected XSS in universal search
- CVE-2026-31803Combodo iTop: Reflected XSS in tag admin
- CVE-2026-30890Combodo iTop: Reflected XSS in synchro/synchro_import.php
- CVE-2026-30865Combodo iTop: Reflected XSS in dashboard save
- CVE-2026-30826Combodo iTop: Reflected XSS in run_query.php
- CVE-2026-30819Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter
- CVE-2026-27490Combodo iTop: Weak secret generation for inline image
- CVE-2026-27463Combodo iTop: Version disclosure via login page logo
- CVE-2026-27462Combodo iTop: User enumeration via password reset
- CVE-2026-30866Combodo iTop: Insecured access to uploaded images via sniffed url
- CVE-2025-64167Combodo iTop vulnerable to reflected XSS in webservices/export.php
- CVE-2025-49145iTop admin can drop iTop database using webhooks
- CVE-2025-48878Combodo iTop vulnerable to IDOR with ModuleInstallation object
- CVE-2025-48065Combodo iTop vulnerable to reflected XSS via objection edition form error
- CVE-2025-48055Combodo iTop has stored XSS in user portal's browse brick
- CVE-2025-47932Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard
- CVE-2025-47773Combodo iTop has XSS vulnerability in /pages/ajax.render.php
- CVE-2025-47286Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality