Threat database

Combodo iTop versions 3.1.0 through 3.3.0 have a missing authorization vulnerability in LinkSetController.php. Authenticated console users can bypass profile grants by manipulating class and key parameters, enabling unauthorized deletion, detachment, and reading of object attributes. The vulnerability has a medium severity with a CVSS score of 5.3.

Combodo iTop versions prior to 3.2.3 contain a vulnerability in the user preference functionality that allows PHP object injection, potentially leading to remote code execution. This vulnerability is identified as CWE-502 (Deserialization of Untrusted Data) and CWE-94 (Code Injection). The issue has been resolved in version 3.2.3.

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.

CVE-2026-34949 is a vulnerability in Combodo iTop, a web-based IT service management tool. Versions prior to 3.2.3 allow an unauthenticated user to delete the .readonly file, which is created during setup to prevent write actions. This missing authentication for a critical function could enable unauthorized modification of the system. The issue is fixed in version 3.2.3.

CVE-2026-34948 is a vulnerability in Combodo iTop, a web-based IT service management tool, where sensitive information could be exposed to unauthorized actors due to incomplete access checks in Object Query Language (OQL). Versions prior to 3.2.3 are affected. The issue has been fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 contain an authorization bypass vulnerability in ajax.render.php and ajax.document.php. This flaw allows unauthorized users to access documents without proper permission checks. The issue was fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 contain a vulnerability that allows unauthenticated remote attackers to bypass authentication and execute arbitrary PHP files from the env-production directory on new iTop instances in production environments. This issue has been fixed in version 3.2.3.

A vulnerability in Combodo iTop prior to version 3.2.3 allows sensitive information to be disclosed through error messages. This issue is classified under CWE-209, which involves generation of error messages containing sensitive information. The vulnerability has a low severity score and has been fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 contain a reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This vulnerability allows an attacker to inject malicious scripts that could be executed in the context of a user's browser. The issue has been fixed in version 3.2.3.

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 contain a missing authorization vulnerability that allows users with limited privileges to access unauthorized object information via the search operation. This issue has been addressed and fixed in version 3.2.3.

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 contain a reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of the affected application. The issue has been fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 contain a reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of the victim's browser. The issue has been fixed in version 3.2.3.

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 use a weak 24-bit pseudo-random secret to protect inline images accessible without authentication. This insufficient entropy vulnerability allows potential attackers to predict or guess the secret, potentially exposing these images. The issue has been fixed in version 3.2.3.

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3.