Threat database

Combodo iTop versions prior to 3.2.3 have a vulnerability in the password reset mechanism that allows user enumeration through observable differences in responses to valid versus invalid usernames. This issue has been addressed and fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 contain a vulnerability where unauthenticated users can access sensitive uploaded files via sniffed URLs. This issue is due to missing authentication controls on critical functions. The vulnerability has been fixed in version 3.2.3.

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack (leading to JS execution) when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead.

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.

Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g.with Service desk agent profile) to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2 fixes the issue.

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content.

Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.

CVE-2025-47932 is a high-severity cross-site scripting (XSS) vulnerability affecting Combodo iTop versions prior to 2.7.13 and between 3.0.0-alpha and before 3.2.2. The flaw arises from improper input neutralization during AJAX-based dashboard rendering, allowing attackers to inject malicious scripts. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of affected systems without requiring authentication but does require user interaction. The vulnerability has a CVSS score of 8.

CVE-2025-47773 is a high-severity cross-site scripting (XSS) vulnerability affecting Combodo iTop versions prior to 2.7.13 and between 3.0.0-alpha and 3.2.2. The flaw arises from improper neutralization of input during web page generation when dashboards are edited via AJAX calls, allowing attackers to inject malicious scripts. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of affected systems without requiring authentication but does require user interaction. Although no known exploits are currently observed in the wild, the vulnerability's CVSS score of 8.

CVE-2025-47286 is a high-severity code injection vulnerability in Combodo iTop, a web-based IT service management tool. It affects versions prior to 2.7.13 and between 3.0.0-alpha and before 3.2.2. An authenticated administrator can exploit improper neutralization of special elements in configuration parameters to execute arbitrary code on the server. The vulnerability requires administrator privileges but no user interaction, and it allows full compromise of confidentiality, integrity, and availability of the affected system.