# cve.now: Combodo

The newest entries naming Combodo as an affected vendor (up to 200), of 88 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108717](https://cve.now/CVE-2026-108717.md): Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController (CVSS 5.3)
- [CVE-2026-40877](https://cve.now/CVE-2026-40877.md): Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences (CVSS 8.7)
- [CVE-2026-30864](https://cve.now/CVE-2026-30864.md): Combodo iTop: Reflected XSS in dashboard revert (CVSS 8.9)
- [CVE-2026-39975](https://cve.now/CVE-2026-39975.md): Combodo iTop: Remote code execution using external auth variable value (CVSS 9.4)
- [CVE-2026-34949](https://cve.now/CVE-2026-34949.md): Combodo iTop: Unauthenticated user can delete .readonly file (CVSS 6.5)
- [CVE-2026-34948](https://cve.now/CVE-2026-34948.md): Combodo iTop: Access control bypass via OQL joins (CVSS 7.7)
- [CVE-2026-34836](https://cve.now/CVE-2026-34836.md): Combodo iTop: Improper access control in ajax.render.php and ajax.document.php (CVSS 6.5)
- [CVE-2026-34741](https://cve.now/CVE-2026-34741.md): Combodo iTop: Authentication bypass in exec.php allows PHP file execution (CVSS 8.6)
- [CVE-2026-33333](https://cve.now/CVE-2026-33333.md): Combodo iTop: Information disclosure in ajax.render.php (CVSS 3.5)
- [CVE-2026-33240](https://cve.now/CVE-2026-33240.md): Combodo iTop: Reflected XSS in foreign key search criteria (CVSS 8.8)
- [CVE-2026-33047](https://cve.now/CVE-2026-33047.md): Combodo iTop: Object can be locked by a user without write permissions (CVSS 4.3)
- [CVE-2026-31936](https://cve.now/CVE-2026-31936.md): Combodo iTop: Unauthorized access to object information via search operation (CVSS 8.8)
- [CVE-2026-31880](https://cve.now/CVE-2026-31880.md): Combodo iTop: Reflected XSS in universal search (CVSS 8.0)
- [CVE-2026-31803](https://cve.now/CVE-2026-31803.md): Combodo iTop: Reflected XSS in tag admin (CVSS 8.0)
- [CVE-2026-30890](https://cve.now/CVE-2026-30890.md): Combodo iTop: Reflected XSS in synchro/synchro\_import.php (CVSS 8.0)
- [CVE-2026-30865](https://cve.now/CVE-2026-30865.md): Combodo iTop: Reflected XSS in dashboard save (CVSS 7.1)
- [CVE-2026-30826](https://cve.now/CVE-2026-30826.md): Combodo iTop: Reflected XSS in run\_query.php (CVSS 8.0)
- [CVE-2026-30819](https://cve.now/CVE-2026-30819.md): Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard\_id parameter (CVSS 7.3)
- [CVE-2026-27490](https://cve.now/CVE-2026-27490.md): Combodo iTop: Weak secret generation for inline image (CVSS 7.5)
- [CVE-2026-27463](https://cve.now/CVE-2026-27463.md): Combodo iTop: Version disclosure via login page logo (CVSS 5.3)
- [CVE-2026-27462](https://cve.now/CVE-2026-27462.md): Combodo iTop: User enumeration via password reset (CVSS 7.5)
- [CVE-2026-30866](https://cve.now/CVE-2026-30866.md): Combodo iTop: Insecured access to uploaded images via sniffed url (CVSS 7.5)
- [CVE-2025-64167](https://cve.now/CVE-2025-64167.md): Combodo iTop vulnerable to reflected XSS in webservices/export.php (CVSS 7.1)
- [CVE-2025-49145](https://cve.now/CVE-2025-49145.md): iTop admin can drop iTop database using webhooks (CVSS 8.7)
- [CVE-2025-48878](https://cve.now/CVE-2025-48878.md): Combodo iTop vulnerable to IDOR with ModuleInstallation object (CVSS 4.3)
- [CVE-2025-48065](https://cve.now/CVE-2025-48065.md): Combodo iTop vulnerable to reflected XSS via objection edition form error (CVSS 8.8)
- [CVE-2025-48055](https://cve.now/CVE-2025-48055.md): Combodo iTop has stored XSS in user portal's browse brick (CVSS 8.5)
- [CVE-2025-47932](https://cve.now/CVE-2025-47932.md): Combodo iTop vulnerable to reflected XSS in ajax.render.php render\_dashboard (CVSS 8.8)
- [CVE-2025-47773](https://cve.now/CVE-2025-47773.md): Combodo iTop has XSS vulnerability in /pages/ajax.render.php (CVSS 8.8)
- [CVE-2025-47286](https://cve.now/CVE-2025-47286.md): Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality (CVSS 8.6)
- [CVE-2025-24969](https://cve.now/CVE-2025-24969.md): iTop portal user can see any other contact's picture (CVSS 5.0)
- [CVE-2025-24785](https://cve.now/CVE-2025-24785.md): iTop dashboard vulnerable to denial of service (CVSS 4.3)
- [CVE-2025-24026](https://cve.now/CVE-2025-24026.md): iTop Inefficient Regular Expression Complexity vulnerability (CVSS 5.3)
- [CVE-2025-24022](https://cve.now/CVE-2025-24022.md): iTop server vulnerable to portal code injection (CVSS 8.6)
- [CVE-2025-24021](https://cve.now/CVE-2025-24021.md): iTop doesn't have mass assignment of fields in the portal form (CVSS 5.0)
- [CVE-2024-56157](https://cve.now/CVE-2024-56157.md): iTop vulnerable to Self XSS in CSV Import (CVSS 6.3)
- [CVE-2024-52601](https://cve.now/CVE-2024-52601.md): iTop portal Insecure Direct Object Reference vulnerability (CVSS 6.5)
- [CVE-2025-27139](https://cve.now/CVE-2025-27139.md): Combodo iTop vulnerable to stored self Cross-site Scripting in preferences (CVSS 6.8)
- [CVE-2024-54139](https://cve.now/CVE-2024-54139.md): Combodo iTop vulnerable to XSS leading to CSRF breach on \_table\_id parameter (CVSS 7.9)
- [CVE-2024-52000](https://cve.now/CVE-2024-52000.md): Reflected Cross-site Scripting exploit in Combodo iTop (CVSS 8.1)
- [CVE-2024-52001](https://cve.now/CVE-2024-52001.md): Portal user is able to access forbidden services information in Combodo iTop (CVSS 4.3)
- [CVE-2024-52002](https://cve.now/CVE-2024-52002.md): Cross-Site Request Forgery (CSRF) in several iTop pages (CVSS 7.6)
- [CVE-2024-51993](https://cve.now/CVE-2024-51993.md): Password is stored in clear in the database in Combodo iTop (CVSS 3.4)
- [CVE-2024-51994](https://cve.now/CVE-2024-51994.md): Cross-site Scripting in portal picture upload in Combodo iTop (CVSS 7.1)
- [CVE-2024-51995](https://cve.now/CVE-2024-51995.md): Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop (CVSS 7.1)
- [CVE-2024-51740](https://cve.now/CVE-2024-51740.md): SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop (CVSS 4.3)
- [CVE-2024-51739](https://cve.now/CVE-2024-51739.md): Users enumeration allowed through Rest API in Combodo iTop (CVSS 7.5)
- [CVE-2024-32870](https://cve.now/CVE-2024-32870.md): iTop hub connector Information disclosure (CVSS 5.8)
- [CVE-2024-31998](https://cve.now/CVE-2024-31998.md): CSRF security issue on CSV import in Combodo iTop (CVSS 8.8)
- [CVE-2024-31448](https://cve.now/CVE-2024-31448.md): Cross-site Scripting vulnerability in link CSV import in Combodo iTop (CVSS 8.8)
- [CVE-2023-34445](https://cve.now/CVE-2023-34445.md): Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTop (CVSS 8.8)
- [CVE-2023-34444](https://cve.now/CVE-2023-34444.md): Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop (CVSS 8.8)
- [CVE-2023-34443](https://cve.now/CVE-2023-34443.md): Cross-site Scripting vulnerability in the run\_query.php page in Combodo iTop (CVSS 8.8)
- [CVE-2023-48710](https://cve.now/CVE-2023-48710.md): iTop limit pages/exec.php script to PHP files (CVSS 9.8)
- [CVE-2023-48709](https://cve.now/CVE-2023-48709.md): iTop vulnerable to potential formula injection in Excel/CSV export file (CVSS 8.0)
- [CVE-2023-47626](https://cve.now/CVE-2023-47626.md): iTop vulnerable to XSS vulnerability in authent-token (CVSS 8.8)
- [CVE-2023-47622](https://cve.now/CVE-2023-47622.md): iTop vulnerable to XSS vulnerability in dashlet refresh (CVSS 8.8)
- [CVE-2023-47123](https://cve.now/CVE-2023-47123.md): iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget (CVSS 8.7)
- [CVE-2023-45808](https://cve.now/CVE-2023-45808.md): iTop missing silo check on extkey in console and portal (CVSS 4.1)
- [CVE-2023-44396](https://cve.now/CVE-2023-44396.md): iTop vulnerable to XSS in dashlet modifications ajax endpoints (CVSS 6.8)
- [CVE-2023-43790](https://cve.now/CVE-2023-43790.md): iTop vulnerable to XSS in friendlyname in object details (CVSS 5.7)
- [CVE-2023-38511](https://cve.now/CVE-2023-38511.md): iTop Dashboard editor vulnerable dashboard config file parameter (CVSS 5.0)
- [CVE-2023-34447](https://cve.now/CVE-2023-34447.md): iTop XSS vulnerability on pages/UI.php (CVSS 8.8)
- [CVE-2023-34446](https://cve.now/CVE-2023-34446.md): iTop XSS vulnerability on pages/preferences.php (CVSS 8.8)
- [CVE-2022-39216](https://cve.now/CVE-2022-39216.md): Combodo iTop's weak password reset token leads to account takeover (CVSS 7.4)
- [CVE-2022-39214](https://cve.now/CVE-2022-39214.md): Authenticated users of Combodo iTop can take over any account (CVSS 9.6)
- [CVE-2021-41162](https://cve.now/CVE-2021-41162.md): Cross-site Scripting in Combodo iTop (CVSS 9.3)
- [CVE-2022-24870](https://cve.now/CVE-2022-24870.md): Stored Cross-site Scripting in Combodo iTop (CVSS 8.7)
- [CVE-2021-41161](https://cve.now/CVE-2021-41161.md): XSS in csvimport in 3.0.0-beta versions (CVSS 9.3)
- [CVE-2022-24811](https://cve.now/CVE-2022-24811.md): Cross-site Scripting in Combodo iTop (CVSS 5.4)
- [CVE-2022-24780](https://cve.now/CVE-2022-24780.md): Code Injection in Combodo iTop (CVSS 8.8)
- [CVE-2021-41245](https://cve.now/CVE-2021-41245.md): Possible Cross-Site Request Forgery in Combodo iTop (CVSS 6.5)
- [CVE-2021-32664](https://cve.now/CVE-2021-32664.md): Reflected XSS in Combodo/iTop (CVSS 8.1)
- [CVE-2021-32663](https://cve.now/CVE-2021-32663.md): Unauthorized setup leads to SSRF in Combodo/iTop (CVSS 8.7)
- [CVE-2021-32776](https://cve.now/CVE-2021-32776.md): No CSRF form token cleanup on Windows servers (CVSS 6.8)
- [CVE-2021-32775](https://cve.now/CVE-2021-32775.md): Any user can see any fields (including mailbox password) with GroupBy Dashlet (CVSS 7.7)
- [CVE-2021-21407](https://cve.now/CVE-2021-21407.md): Portal : the CSRF token isn't validated (CVSS 8.0)
- [CVE-2021-21406](https://cve.now/CVE-2021-21406.md): Command Injection vulnerability in the Setup Wizard (CVSS 5.8)
- [CVE-2020-15221](https://cve.now/CVE-2020-15221.md): XSS in the breadcrumbs (CVSS 6.8)
- [CVE-2020-15220](https://cve.now/CVE-2020-15220.md): Session fixation (CVSS 6.1)
- [CVE-2020-15219](https://cve.now/CVE-2020-15219.md): SQL query displayed on portal error (CVSS 4.3)
- [CVE-2020-15218](https://cve.now/CVE-2020-15218.md): Admin pages are cached and can be embedded (CVSS 6.8)
- [CVE-2020-4079](https://cve.now/CVE-2020-4079.md): Information disclosure vulnerability in iTop (CVSS 7.7)
- [CVE-2020-12781](https://cve.now/CVE-2020-12781.md): Combodo iTop - CSRF (CVSS 5.7)
- [CVE-2020-12780](https://cve.now/CVE-2020-12780.md): Combodo iTop - Security Misconfiguration (CVSS 7.5)
- [CVE-2020-12779](https://cve.now/CVE-2020-12779.md): Combodo iTop - Stored XSS (CVSS 6.8)
- [CVE-2020-12778](https://cve.now/CVE-2020-12778.md): Combodo iTop - Reflected XSS (CVSS 7.4)
- [CVE-2020-12777](https://cve.now/CVE-2020-12777.md): Combodo iTop - Broken Access Control (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/combodo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.