Vulnerabilidades do Combodo Itop
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Combodo Itop: 30 registro(s), com versões afetadas e correções.cpe:2.3:a:combodo:itop
CVE-2025-48065
Média · 6.1
CWE-79 10/11/2025
Combodo iTop vulnerable to reflected XSS via objection edition form error
Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content.
CVE-2025-48055
Média · 5.4
CWE-79 10/11/2025
Combodo iTop has stored XSS in user portal's browse brick
Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.
CVE-2025-47932
Média · 6.1
CWE-79 10/11/2025
Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard
Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is rendered via an AJAX call. Versions 2.7.13 and 3.2.2 sanitize the var responsible for the attack.
CVE-2025-47773
Média · 6.1
CWE-79 10/11/2025
Combodo iTop has XSS vulnerability in /pages/ajax.render.php
Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited via an AJAX call. Versions 2.7.13 and 3.2.2 protect rendered HTML content.
CVE-2025-47286
Alta · 7.2
CWE-74 10/11/2025
Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality
Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on it.