Combodo vulnerabilities
88 CVEs and advisories name Combodo as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-24969iTop portal user can see any other contact's picture
- CVE-2025-24785iTop dashboard vulnerable to denial of service
- CVE-2025-24026iTop Inefficient Regular Expression Complexity vulnerability
- CVE-2025-24022iTop server vulnerable to portal code injection
- CVE-2025-24021iTop doesn't have mass assignment of fields in the portal form
- CVE-2024-56157iTop vulnerable to Self XSS in CSV Import
- CVE-2024-52601iTop portal Insecure Direct Object Reference vulnerability
- CVE-2025-27139Combodo iTop vulnerable to stored self Cross-site Scripting in preferences
- CVE-2024-54139Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter
- CVE-2024-52000Reflected Cross-site Scripting exploit in Combodo iTop
- CVE-2024-52001Portal user is able to access forbidden services information in Combodo iTop
- CVE-2024-52002Cross-Site Request Forgery (CSRF) in several iTop pages
- CVE-2024-51993Password is stored in clear in the database in Combodo iTop
- CVE-2024-51994Cross-site Scripting in portal picture upload in Combodo iTop
- CVE-2024-51995Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop
- CVE-2024-51740SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop
- CVE-2024-51739Users enumeration allowed through Rest API in Combodo iTop
- CVE-2024-32870iTop hub connector Information disclosure
- CVE-2024-31998CSRF security issue on CSV import in Combodo iTop
- CVE-2024-31448Cross-site Scripting vulnerability in link CSV import in Combodo iTop
- CVE-2023-34445Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTop
- CVE-2023-34444Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop
- CVE-2023-34443Cross-site Scripting vulnerability in the run_query.php page in Combodo iTop
- CVE-2023-48710iTop limit pages/exec.php script to PHP files
- CVE-2023-48709iTop vulnerable to potential formula injection in Excel/CSV export file
- CVE-2023-47626iTop vulnerable to XSS vulnerability in authent-token
- CVE-2023-47622iTop vulnerable to XSS vulnerability in dashlet refresh
- CVE-2023-47123iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget
- CVE-2023-45808iTop missing silo check on extkey in console and portal
- CVE-2023-44396iTop vulnerable to XSS in dashlet modifications ajax endpoints