# Combodo iTop. Every CVE that names Combodo iTop among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController](https://agentprime.io/advisories/CVE-2026-108717.md) `CVE-2026-108717` · CVE record: Combodo iTop · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control - [Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences](https://agentprime.io/advisories/CVE-2026-40877.md) `CVE-2026-40877` · CVE record: Combodo iTop · CVSS 8.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: Code injection, Insecure deserialization - [Combodo iTop: Reflected XSS in dashboard revert](https://agentprime.io/advisories/CVE-2026-30864.md) `CVE-2026-30864` · CVE record: Combodo iTop · CVSS 8.9 High · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Remote code execution using external auth variable value](https://agentprime.io/advisories/CVE-2026-39975.md) `CVE-2026-39975` · CVE record: Combodo iTop · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Code injection - [Combodo iTop: Unauthenticated user can delete .readonly file](https://agentprime.io/advisories/CVE-2026-34949.md) `CVE-2026-34949` · CVE record: Combodo iTop · CVSS 6.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Authentication bypass - [Combodo iTop: Access control bypass via OQL joins](https://agentprime.io/advisories/CVE-2026-34948.md) `CVE-2026-34948` · CVE record: Combodo iTop · CVSS 7.7 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Combodo iTop: Improper access control in ajax.render.php and ajax.document.php](https://agentprime.io/advisories/CVE-2026-34836.md) `CVE-2026-34836` · CVE record: Combodo iTop · CVSS 6.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Broken access control - [Combodo iTop: Authentication bypass in exec.php allows PHP file execution](https://agentprime.io/advisories/CVE-2026-34741.md) `CVE-2026-34741` · CVE record: Combodo iTop · CVSS 8.6 High · Not analysed yet · Published 21 Aug 2026 · Tags: Authentication bypass - [Combodo iTop: Information disclosure in ajax.render.php](https://agentprime.io/advisories/CVE-2026-33333.md) `CVE-2026-33333` · CVE record: Combodo iTop · CVSS 3.5 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Combodo iTop: Reflected XSS in foreign key search criteria](https://agentprime.io/advisories/CVE-2026-33240.md) `CVE-2026-33240` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Object can be locked by a user without write permissions](https://agentprime.io/advisories/CVE-2026-33047.md) `CVE-2026-33047` · CVE record: Combodo iTop · CVSS 4.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Broken access control - [Combodo iTop: Unauthorized access to object information via search operation](https://agentprime.io/advisories/CVE-2026-31936.md) `CVE-2026-31936` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Broken access control - [Combodo iTop: Reflected XSS in universal search](https://agentprime.io/advisories/CVE-2026-31880.md) `CVE-2026-31880` · CVE record: Combodo iTop · CVSS 8.0 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in tag admin](https://agentprime.io/advisories/CVE-2026-31803.md) `CVE-2026-31803` · CVE record: Combodo iTop · CVSS 8.0 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in synchro/synchro_import.php](https://agentprime.io/advisories/CVE-2026-30890.md) `CVE-2026-30890` · CVE record: Combodo iTop · CVSS 8.0 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in dashboard save](https://agentprime.io/advisories/CVE-2026-30865.md) `CVE-2026-30865` · CVE record: Combodo iTop · CVSS 7.1 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in run_query.php](https://agentprime.io/advisories/CVE-2026-30826.md) `CVE-2026-30826` · CVE record: Combodo iTop · CVSS 8.0 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter](https://agentprime.io/advisories/CVE-2026-30819.md) `CVE-2026-30819` · CVE record: Combodo iTop · CVSS 7.3 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Weak secret generation for inline image](https://agentprime.io/advisories/CVE-2026-27490.md) `CVE-2026-27490` · CVE record: Combodo iTop · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Weak cryptography or TLS, CWE-331 - [Combodo iTop: Version disclosure via login page logo](https://agentprime.io/advisories/CVE-2026-27463.md) `CVE-2026-27463` · CVE record: Combodo iTop · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure - [Combodo iTop: User enumeration via password reset](https://agentprime.io/advisories/CVE-2026-27462.md) `CVE-2026-27462` · CVE record: Combodo iTop · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-204 - [Combodo iTop: Insecured access to uploaded images via sniffed url](https://agentprime.io/advisories/CVE-2026-30866.md) `CVE-2026-30866` · CVE record: Combodo iTop · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, Authentication bypass - [Combodo iTop vulnerable to reflected XSS in webservices/export.php](https://agentprime.io/advisories/CVE-2025-64167.md) `CVE-2025-64167` · CVE record: Combodo iTop · CVSS 7.1 High · Not analysed yet · Published 10 Nov 2025 · Tags: Cross-site scripting (XSS) - [iTop admin can drop iTop database using webhooks](https://agentprime.io/advisories/CVE-2025-49145.md) `CVE-2025-49145` · CVE record: Combodo iTop · CVSS 8.7 High · Not analysed yet · Published 10 Nov 2025 · Tags: Broken access control - [Combodo iTop vulnerable to IDOR with ModuleInstallation object](https://agentprime.io/advisories/CVE-2025-48878.md) `CVE-2025-48878` · CVE record: Combodo iTop · CVSS 4.3 Medium · Not analysed yet · Published 10 Nov 2025 · Tags: Broken access control - [Combodo iTop vulnerable to reflected XSS via objection edition form error](https://agentprime.io/advisories/CVE-2025-48065.md) `CVE-2025-48065` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 10 Nov 2025 · Tags: Cross-site scripting (XSS) - [Combodo iTop has stored XSS in user portal's browse brick](https://agentprime.io/advisories/CVE-2025-48055.md) `CVE-2025-48055` · CVE record: Combodo iTop · CVSS 8.5 High · Not analysed yet · Published 10 Nov 2025 · Tags: Cross-site scripting (XSS) - [Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard](https://agentprime.io/advisories/CVE-2025-47932.md) `CVE-2025-47932` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 10 Nov 2025 · Tags: Cross-site scripting (XSS) - [Combodo iTop has XSS vulnerability in /pages/ajax.render.php](https://agentprime.io/advisories/CVE-2025-47773.md) `CVE-2025-47773` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 10 Nov 2025 · Tags: Cross-site scripting (XSS) - [Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality](https://agentprime.io/advisories/CVE-2025-47286.md) `CVE-2025-47286` · CVE record: Combodo iTop · CVSS 8.6 High · Not analysed yet · Published 10 Nov 2025 · Tags: Other injection - [iTop portal user can see any other contact's picture](https://agentprime.io/advisories/CVE-2025-24969.md) `CVE-2025-24969` · CVE record: Combodo iTop · CVSS 5.0 Medium · Not analysed yet · Published 14 May 2025 · Tags: Broken access control - [iTop dashboard vulnerable to denial of service](https://agentprime.io/advisories/CVE-2025-24785.md) `CVE-2025-24785` · CVE record: Combodo iTop · CVSS 4.3 Medium · Not analysed yet · Published 14 May 2025 · Tags: CWE-20 - [iTop Inefficient Regular Expression Complexity vulnerability](https://agentprime.io/advisories/CVE-2025-24026.md) `CVE-2025-24026` · CVE record: Combodo iTop · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2025 · Tags: Denial of service - [iTop server vulnerable to portal code injection](https://agentprime.io/advisories/CVE-2025-24022.md) `CVE-2025-24022` · CVE record: Combodo iTop · CVSS 8.6 High · Not analysed yet · Published 14 May 2025 · Tags: Command injection - [iTop doesn't have mass assignment of fields in the portal form](https://agentprime.io/advisories/CVE-2025-24021.md) `CVE-2025-24021` · CVE record: Combodo iTop · CVSS 5.0 Medium · Not analysed yet · Published 14 May 2025 · Tags: Broken access control - [iTop vulnerable to Self XSS in CSV Import](https://agentprime.io/advisories/CVE-2024-56157.md) `CVE-2024-56157` · CVE record: Combodo iTop · CVSS 6.3 Medium · Not analysed yet · Published 14 May 2025 · Tags: Cross-site scripting (XSS) - [iTop portal Insecure Direct Object Reference vulnerability](https://agentprime.io/advisories/CVE-2024-52601.md) `CVE-2024-52601` · CVE record: Combodo iTop · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2025 · Tags: Broken access control - [Combodo iTop vulnerable to stored self Cross-site Scripting in preferences](https://agentprime.io/advisories/CVE-2025-27139.md) `CVE-2025-27139` · CVE record: Combodo iTop · CVSS 6.8 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: Cross-site scripting (XSS) - [Combodo iTop vulnerable to XSS leading to CSRF breach on \_table_id parameter](https://agentprime.io/advisories/CVE-2024-54139.md) `CVE-2024-54139` · CVE record: Combodo iTop · CVSS 7.9 High · Not analysed yet · Published 13 Dec 2024 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF) - [Reflected Cross-site Scripting exploit in Combodo iTop](https://agentprime.io/advisories/CVE-2024-52000.md) `CVE-2024-52000` · CVE record: Combodo iTop · CVSS 8.1 High · Not analysed yet · Published 8 Nov 2024 · Tags: Cross-site scripting (XSS) - [Portal user is able to access forbidden services information in Combodo iTop](https://agentprime.io/advisories/CVE-2024-52001.md) `CVE-2024-52001` · CVE record: Combodo iTop · CVSS 4.3 Medium · Not analysed yet · Published 8 Nov 2024 · Tags: Information disclosure - [Cross-Site Request Forgery (CSRF) in several iTop pages](https://agentprime.io/advisories/CVE-2024-52002.md) `CVE-2024-52002` · CVE record: Combodo iTop · CVSS 7.6 High · Not analysed yet · Published 8 Nov 2024 · Tags: Cross-site request forgery (CSRF) - [Password is stored in clear in the database in Combodo iTop](https://agentprime.io/advisories/CVE-2024-51993.md) `CVE-2024-51993` · CVE record: Combodo iTop · CVSS 3.4 Low · Not analysed yet · Published 7 Nov 2024 · Tags: Information disclosure - [Cross-site Scripting in portal picture upload in Combodo iTop](https://agentprime.io/advisories/CVE-2024-51994.md) `CVE-2024-51994` · CVE record: Combodo iTop · CVSS 7.1 High · Not analysed yet · Published 7 Nov 2024 · Tags: Cross-site scripting (XSS) - [Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop](https://agentprime.io/advisories/CVE-2024-51995.md) `CVE-2024-51995` · CVE record: Combodo iTop · CVSS 7.1 High · Not analysed yet · Published 7 Nov 2024 · Tags: Broken access control - [SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop](https://agentprime.io/advisories/CVE-2024-51740.md) `CVE-2024-51740` · CVE record: Combodo iTop · CVSS 4.3 Medium · Not analysed yet · Published 5 Nov 2024 · Tags: Server-side request forgery (SSRF) - [Users enumeration allowed through Rest API in Combodo iTop](https://agentprime.io/advisories/CVE-2024-51739.md) `CVE-2024-51739` · CVE record: Combodo iTop · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2024 · Tags: Information disclosure - [iTop hub connector Information disclosure](https://agentprime.io/advisories/CVE-2024-32870.md) `CVE-2024-32870` · CVE record: Combodo iTop · CVSS 5.8 Medium · Not analysed yet · Published 4 Nov 2024 · Tags: Information disclosure - [CSRF security issue on CSV import in Combodo iTop](https://agentprime.io/advisories/CVE-2024-31998.md) `CVE-2024-31998` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2024 · Tags: Cross-site request forgery (CSRF) - [Cross-site Scripting vulnerability in link CSV import in Combodo iTop](https://agentprime.io/advisories/CVE-2024-31448.md) `CVE-2024-31448` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2024 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTop](https://agentprime.io/advisories/CVE-2023-34445.md) `CVE-2023-34445` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2024 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop](https://agentprime.io/advisories/CVE-2023-34444.md) `CVE-2023-34444` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2024 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting vulnerability in the run_query.php page in Combodo iTop](https://agentprime.io/advisories/CVE-2023-34443.md) `CVE-2023-34443` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2024 · Tags: Cross-site scripting (XSS) - [iTop limit pages/exec.php script to PHP files](https://agentprime.io/advisories/CVE-2023-48710.md) `CVE-2023-48710` · CVE record: Combodo iTop · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Apr 2024 · Tags: Information disclosure - [iTop vulnerable to potential formula injection in Excel/CSV export file](https://agentprime.io/advisories/CVE-2023-48709.md) `CVE-2023-48709` · CVE record: Combodo iTop · CVSS 8.0 High · Not analysed yet · Published 15 Apr 2024 · Tags: Other injection - [iTop vulnerable to XSS vulnerability in authent-token](https://agentprime.io/advisories/CVE-2023-47626.md) `CVE-2023-47626` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 15 Apr 2024 · Tags: Cross-site scripting (XSS) - [iTop vulnerable to XSS vulnerability in dashlet refresh](https://agentprime.io/advisories/CVE-2023-47622.md) `CVE-2023-47622` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 15 Apr 2024 · Tags: Cross-site scripting (XSS) - [iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget](https://agentprime.io/advisories/CVE-2023-47123.md) `CVE-2023-47123` · CVE record: Combodo iTop · CVSS 8.7 High · Not analysed yet · Published 15 Apr 2024 · Tags: Cross-site scripting (XSS) - [iTop missing silo check on extkey in console and portal](https://agentprime.io/advisories/CVE-2023-45808.md) `CVE-2023-45808` · CVE record: Combodo iTop · CVSS 4.1 Medium · Not analysed yet · Published 15 Apr 2024 · Tags: Broken access control - [iTop vulnerable to XSS in dashlet modifications ajax endpoints](https://agentprime.io/advisories/CVE-2023-44396.md) `CVE-2023-44396` · CVE record: Combodo iTop · CVSS 6.8 Medium · Not analysed yet · Published 15 Apr 2024 · Tags: Cross-site scripting (XSS) Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .