Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-34949 (GCVE-0-2026-34949)

Vulnerability from nvd – Published: 2026-08-21 22:31 – Updated: 2026-08-21 22:31

Title

Combodo iTop: Unauthenticated user can delete .readonly file

Summary

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances \u2014 a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T22:31:49.110Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-2xh3-r27f-3pr5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-2xh3-r27f-3pr5"
        }
      ],
      "source": {
        "advisory": "GHSA-2xh3-r27f-3pr5",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Unauthenticated user can delete .readonly file"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34949",
    "datePublished": "2026-08-21T22:31:49.110Z",
    "dateReserved": "2026-03-31T17:27:08.661Z",
    "dateUpdated": "2026-08-21T22:31:49.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34948 (GCVE-0-2026-34948)

Vulnerability from nvd – Published: 2026-08-21 22:26 – Updated: 2026-08-21 22:26

Title

Combodo iTop: Access control bypass via OQL joins

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/e467ca83cf…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T22:26:22.269Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-cm4j-52rf-whgc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-cm4j-52rf-whgc"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/e467ca83cfcfc5ba1f1d78a99d4805e595f114ba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/e467ca83cfcfc5ba1f1d78a99d4805e595f114ba"
        }
      ],
      "source": {
        "advisory": "GHSA-cm4j-52rf-whgc",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Access control bypass via OQL joins"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34948",
    "datePublished": "2026-08-21T22:26:22.269Z",
    "dateReserved": "2026-03-31T17:27:08.661Z",
    "dateUpdated": "2026-08-21T22:26:22.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34836 (GCVE-0-2026-34836)

Vulnerability from nvd – Published: 2026-08-21 21:54 – Updated: 2026-08-21 21:54

Title

Combodo iTop: Improper access control in ajax.render.php and ajax.document.php

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/7791585387…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:54:45.168Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-2gvp-4cv3-cx6j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-2gvp-4cv3-cx6j"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/77915853875710f152a873842fa2a84ebd09719b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/77915853875710f152a873842fa2a84ebd09719b"
        }
      ],
      "source": {
        "advisory": "GHSA-2gvp-4cv3-cx6j",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Improper access control in ajax.render.php and ajax.document.php"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34836",
    "datePublished": "2026-08-21T21:54:45.168Z",
    "dateReserved": "2026-03-30T20:52:53.284Z",
    "dateUpdated": "2026-08-21T21:54:45.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34741 (GCVE-0-2026-34741)

Vulnerability from nvd – Published: 2026-08-21 21:50 – Updated: 2026-08-21 21:50

Title

Combodo iTop: Authentication bypass in exec.php allows PHP file execution

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/4fe61cbdc7…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:50:49.229Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-36h9-5qw2-jcc6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-36h9-5qw2-jcc6"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/4fe61cbdc779cb5576395d4ae8be31f9fbc7306c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/4fe61cbdc779cb5576395d4ae8be31f9fbc7306c"
        }
      ],
      "source": {
        "advisory": "GHSA-36h9-5qw2-jcc6",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Authentication bypass in exec.php allows PHP file execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34741",
    "datePublished": "2026-08-21T21:50:49.229Z",
    "dateReserved": "2026-03-30T19:17:10.224Z",
    "dateUpdated": "2026-08-21T21:50:49.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33333 (GCVE-0-2026-33333)

Vulnerability from nvd – Published: 2026-08-21 21:46 – Updated: 2026-08-21 21:46

Title

Combodo iTop: Information disclosure in ajax.render.php

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/170014e8f0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:46:00.590Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-ghr8-5898-6rjh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-ghr8-5898-6rjh"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/170014e8f0a01fb8f8581902c665ff5c1fcc1168",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/170014e8f0a01fb8f8581902c665ff5c1fcc1168"
        }
      ],
      "source": {
        "advisory": "GHSA-ghr8-5898-6rjh",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Information disclosure in ajax.render.php"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33333",
    "datePublished": "2026-08-21T21:46:00.590Z",
    "dateReserved": "2026-03-18T22:15:11.812Z",
    "dateUpdated": "2026-08-21T21:46:00.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33240 (GCVE-0-2026-33240)

Vulnerability from nvd – Published: 2026-08-21 21:25 – Updated: 2026-08-21 21:25

Title

Combodo iTop: Reflected XSS in foreign key search criteria

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/2a16143e53…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:25:03.819Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-5hw5-fvw4-55p4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-5hw5-fvw4-55p4"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/2a16143e53b4019415db90b6ac89f16fc3f773ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/2a16143e53b4019415db90b6ac89f16fc3f773ff"
        }
      ],
      "source": {
        "advisory": "GHSA-5hw5-fvw4-55p4",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in foreign key search criteria"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33240",
    "datePublished": "2026-08-21T21:25:03.819Z",
    "dateReserved": "2026-03-18T02:42:27.508Z",
    "dateUpdated": "2026-08-21T21:25:03.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33047 (GCVE-0-2026-33047)

Vulnerability from nvd – Published: 2026-08-21 21:21 – Updated: 2026-08-21 21:42

Title

Combodo iTop: Object can be locked by a user without write permissions

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/28db230697…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33047",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:34:49.805883Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:42:15.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:21:53.846Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-3qpj-3fcg-f5jc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3qpj-3fcg-f5jc"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/28db23069732da5322a4dda821135519297e5c29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/28db23069732da5322a4dda821135519297e5c29"
        }
      ],
      "source": {
        "advisory": "GHSA-3qpj-3fcg-f5jc",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Object can be locked by a user without write permissions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33047",
    "datePublished": "2026-08-21T21:21:53.846Z",
    "dateReserved": "2026-03-17T18:10:50.211Z",
    "dateUpdated": "2026-08-21T21:42:15.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31936 (GCVE-0-2026-31936)

Vulnerability from nvd – Published: 2026-08-21 21:17 – Updated: 2026-08-21 21:17

Title

Combodo iTop: Unauthorized access to object information via search operation

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/b3223eb9b6…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:17:44.338Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-3r3r-j29m-3v43",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3r3r-j29m-3v43"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/b3223eb9b6bc1514276f8f321db1e27db6f42808",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/b3223eb9b6bc1514276f8f321db1e27db6f42808"
        }
      ],
      "source": {
        "advisory": "GHSA-3r3r-j29m-3v43",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Unauthorized access to object information via search operation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31936",
    "datePublished": "2026-08-21T21:17:44.338Z",
    "dateReserved": "2026-03-10T15:10:10.654Z",
    "dateUpdated": "2026-08-21T21:17:44.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31880 (GCVE-0-2026-31880)

Vulnerability from nvd – Published: 2026-08-21 20:59 – Updated: 2026-08-21 21:42

Title

Combodo iTop: Reflected XSS in universal search

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/7bfa14a874…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31880",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:20:30.892496Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:42:30.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:59:35.991Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-6qgh-xqjr-4pv7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-6qgh-xqjr-4pv7"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/7bfa14a8744cc599caf0ed347022f8267793d6d9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/7bfa14a8744cc599caf0ed347022f8267793d6d9"
        }
      ],
      "source": {
        "advisory": "GHSA-6qgh-xqjr-4pv7",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in universal search"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31880",
    "datePublished": "2026-08-21T20:59:35.991Z",
    "dateReserved": "2026-03-09T21:59:02.686Z",
    "dateUpdated": "2026-08-21T21:42:30.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31803 (GCVE-0-2026-31803)

Vulnerability from nvd – Published: 2026-08-21 20:52 – Updated: 2026-08-21 21:42

Title

Combodo iTop: Reflected XSS in tag admin

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/ab8e7bd15e…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31803",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:20:33.487286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:42:37.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:52:09.233Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-m27p-8qgh-857g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-m27p-8qgh-857g"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/ab8e7bd15ed251ad4fbe8d4d1b17474b2d688fba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/ab8e7bd15ed251ad4fbe8d4d1b17474b2d688fba"
        }
      ],
      "source": {
        "advisory": "GHSA-m27p-8qgh-857g",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in tag admin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31803",
    "datePublished": "2026-08-21T20:52:09.233Z",
    "dateReserved": "2026-03-09T16:33:42.913Z",
    "dateUpdated": "2026-08-21T21:42:37.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30890 (GCVE-0-2026-30890)

Vulnerability from nvd – Published: 2026-08-21 20:40 – Updated: 2026-08-21 20:40

Title

Combodo iTop: Reflected XSS in synchro/synchro_import.php

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/9236449b21…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:40:05.045Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-93q9-fc8m-5gp5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-93q9-fc8m-5gp5"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/9236449b218142207e2078ea6dc827637f722afc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/9236449b218142207e2078ea6dc827637f722afc"
        }
      ],
      "source": {
        "advisory": "GHSA-93q9-fc8m-5gp5",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in synchro/synchro_import.php"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30890",
    "datePublished": "2026-08-21T20:40:05.045Z",
    "dateReserved": "2026-03-06T00:04:56.700Z",
    "dateUpdated": "2026-08-21T20:40:05.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30865 (GCVE-0-2026-30865)

Vulnerability from nvd – Published: 2026-08-21 20:37 – Updated: 2026-08-21 20:37

Title

Combodo iTop: Reflected XSS in dashboard save

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/330539abd2…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:37:20.408Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-8j4q-ccr6-wpmj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-8j4q-ccr6-wpmj"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/330539abd22b1d4a00cfd698d17ee1c0ffa04da5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/330539abd22b1d4a00cfd698d17ee1c0ffa04da5"
        }
      ],
      "source": {
        "advisory": "GHSA-8j4q-ccr6-wpmj",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in dashboard save"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30865",
    "datePublished": "2026-08-21T20:37:20.408Z",
    "dateReserved": "2026-03-05T21:27:35.343Z",
    "dateUpdated": "2026-08-21T20:37:20.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30826 (GCVE-0-2026-30826)

Vulnerability from nvd – Published: 2026-08-21 20:15 – Updated: 2026-08-21 21:43

Title

Combodo iTop: Reflected XSS in run_query.php

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:00 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/61e5536b50…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30826",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:00:00.812279Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:43:06.834Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:15:42.604Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-m592-x5r5-w2r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-m592-x5r5-w2r2"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/61e5536b500dbf6be3574c5517eaafea27cbfec7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/61e5536b500dbf6be3574c5517eaafea27cbfec7"
        }
      ],
      "source": {
        "advisory": "GHSA-m592-x5r5-w2r2",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in run_query.php"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30826",
    "datePublished": "2026-08-21T20:15:42.604Z",
    "dateReserved": "2026-03-05T21:06:44.606Z",
    "dateUpdated": "2026-08-21T21:43:06.834Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30866 (GCVE-0-2026-30866)

Vulnerability from nvd – Published: 2026-08-21 19:32 – Updated: 2026-08-21 19:32

Title

Combodo iTop: Insecured access to uploaded images via sniffed url

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/458a996c29…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T19:32:00.149Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-8rgc-qjf3-xqq4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-8rgc-qjf3-xqq4"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/458a996c29db73b9ce2d374f6ce8b90c36351159",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/458a996c29db73b9ce2d374f6ce8b90c36351159"
        }
      ],
      "source": {
        "advisory": "GHSA-8rgc-qjf3-xqq4",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Insecured access to uploaded images via sniffed url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30866",
    "datePublished": "2026-08-21T19:32:00.149Z",
    "dateReserved": "2026-03-05T21:27:35.343Z",
    "dateUpdated": "2026-08-21T19:32:00.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30819 (GCVE-0-2026-30819)

Vulnerability from nvd – Published: 2026-08-21 20:05 – Updated: 2026-08-21 20:21

Title

Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 20:21 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/104dd1970f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30819",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T20:21:37.627815Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T20:21:48.873Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:05:47.126Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-gccc-8mw3-hqhp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-gccc-8mw3-hqhp"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/104dd1970f3ad828896a5092b125edb4bc1340b6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/104dd1970f3ad828896a5092b125edb4bc1340b6"
        }
      ],
      "source": {
        "advisory": "GHSA-gccc-8mw3-hqhp",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30819",
    "datePublished": "2026-08-21T20:05:47.126Z",
    "dateReserved": "2026-03-05T21:06:44.605Z",
    "dateUpdated": "2026-08-21T20:21:48.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27490 (GCVE-0-2026-27490)

Vulnerability from nvd – Published: 2026-08-21 19:59 – Updated: 2026-08-21 19:59

Title

Combodo iTop: Weak secret generation for inline image

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-331 - Insufficient Entropy
CWE-330 - Use of Insufficiently Random Values

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
http://github.com/Combodo/iTop/commit/9c39efd9af5…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-331",
              "description": "CWE-331: Insufficient Entropy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-330",
              "description": "CWE-330: Use of Insufficiently Random Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T19:59:29.384Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-3jr5-rqmx-97gc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3jr5-rqmx-97gc"
        },
        {
          "name": "http://github.com/Combodo/iTop/commit/9c39efd9af53a1deeb578133eff7333a7b8816b0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://github.com/Combodo/iTop/commit/9c39efd9af53a1deeb578133eff7333a7b8816b0"
        }
      ],
      "source": {
        "advisory": "GHSA-3jr5-rqmx-97gc",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Weak secret generation for inline image"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27490",
    "datePublished": "2026-08-21T19:59:29.384Z",
    "dateReserved": "2026-02-19T19:46:03.541Z",
    "dateUpdated": "2026-08-21T19:59:29.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27463 (GCVE-0-2026-27463)

Vulnerability from nvd – Published: 2026-08-21 19:57 – Updated: 2026-08-21 21:43

Title

Combodo iTop: Version disclosure via login page logo

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:09 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/d124f8ee58…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27463",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:09:28.106486Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:43:20.794Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T19:57:40.427Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-hm9q-8jx3-f3v5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-hm9q-8jx3-f3v5"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/d124f8ee58fa243193184ac2c55a561acdded356",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/d124f8ee58fa243193184ac2c55a561acdded356"
        }
      ],
      "source": {
        "advisory": "GHSA-hm9q-8jx3-f3v5",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Version disclosure via login page logo"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27463",
    "datePublished": "2026-08-21T19:57:40.427Z",
    "dateReserved": "2026-02-19T17:25:31.101Z",
    "dateUpdated": "2026-08-21T21:43:20.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27462 (GCVE-0-2026-27462)

Vulnerability from nvd – Published: 2026-08-21 19:52 – Updated: 2026-08-21 19:52

Title

Combodo iTop: User enumeration via password reset

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-204 - Observable Response Discrepancy

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/9fd0ffd84e…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-204",
              "description": "CWE-204: Observable Response Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T19:52:04.025Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-888g-gv33-xwwx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-888g-gv33-xwwx"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/9fd0ffd84ee62c1c6ede8d30db5fa0305f11fd01",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/9fd0ffd84ee62c1c6ede8d30db5fa0305f11fd01"
        }
      ],
      "source": {
        "advisory": "GHSA-888g-gv33-xwwx",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: User enumeration via password reset"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27462",
    "datePublished": "2026-08-21T19:52:04.025Z",
    "dateReserved": "2026-02-19T17:25:31.101Z",
    "dateUpdated": "2026-08-21T19:52:04.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34949 (GCVE-0-2026-34949)

Vulnerability from cvelistv5 – Published: 2026-08-21 22:31 – Updated: 2026-08-21 22:31

Title

Combodo iTop: Unauthenticated user can delete .readonly file

Summary

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances \u2014 a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T22:31:49.110Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-2xh3-r27f-3pr5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-2xh3-r27f-3pr5"
        }
      ],
      "source": {
        "advisory": "GHSA-2xh3-r27f-3pr5",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Unauthenticated user can delete .readonly file"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34949",
    "datePublished": "2026-08-21T22:31:49.110Z",
    "dateReserved": "2026-03-31T17:27:08.661Z",
    "dateUpdated": "2026-08-21T22:31:49.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34948 (GCVE-0-2026-34948)

Vulnerability from cvelistv5 – Published: 2026-08-21 22:26 – Updated: 2026-08-21 22:26

Title

Combodo iTop: Access control bypass via OQL joins

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/e467ca83cf…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T22:26:22.269Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-cm4j-52rf-whgc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-cm4j-52rf-whgc"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/e467ca83cfcfc5ba1f1d78a99d4805e595f114ba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/e467ca83cfcfc5ba1f1d78a99d4805e595f114ba"
        }
      ],
      "source": {
        "advisory": "GHSA-cm4j-52rf-whgc",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Access control bypass via OQL joins"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34948",
    "datePublished": "2026-08-21T22:26:22.269Z",
    "dateReserved": "2026-03-31T17:27:08.661Z",
    "dateUpdated": "2026-08-21T22:26:22.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34836 (GCVE-0-2026-34836)

Vulnerability from cvelistv5 – Published: 2026-08-21 21:54 – Updated: 2026-08-21 21:54

Title

Combodo iTop: Improper access control in ajax.render.php and ajax.document.php

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/7791585387…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:54:45.168Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-2gvp-4cv3-cx6j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-2gvp-4cv3-cx6j"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/77915853875710f152a873842fa2a84ebd09719b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/77915853875710f152a873842fa2a84ebd09719b"
        }
      ],
      "source": {
        "advisory": "GHSA-2gvp-4cv3-cx6j",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Improper access control in ajax.render.php and ajax.document.php"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34836",
    "datePublished": "2026-08-21T21:54:45.168Z",
    "dateReserved": "2026-03-30T20:52:53.284Z",
    "dateUpdated": "2026-08-21T21:54:45.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34741 (GCVE-0-2026-34741)

Vulnerability from cvelistv5 – Published: 2026-08-21 21:50 – Updated: 2026-08-21 21:50

Title

Combodo iTop: Authentication bypass in exec.php allows PHP file execution

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/4fe61cbdc7…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:50:49.229Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-36h9-5qw2-jcc6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-36h9-5qw2-jcc6"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/4fe61cbdc779cb5576395d4ae8be31f9fbc7306c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/4fe61cbdc779cb5576395d4ae8be31f9fbc7306c"
        }
      ],
      "source": {
        "advisory": "GHSA-36h9-5qw2-jcc6",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Authentication bypass in exec.php allows PHP file execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34741",
    "datePublished": "2026-08-21T21:50:49.229Z",
    "dateReserved": "2026-03-30T19:17:10.224Z",
    "dateUpdated": "2026-08-21T21:50:49.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33333 (GCVE-0-2026-33333)

Vulnerability from cvelistv5 – Published: 2026-08-21 21:46 – Updated: 2026-08-21 21:46

Title

Combodo iTop: Information disclosure in ajax.render.php

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/170014e8f0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:46:00.590Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-ghr8-5898-6rjh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-ghr8-5898-6rjh"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/170014e8f0a01fb8f8581902c665ff5c1fcc1168",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/170014e8f0a01fb8f8581902c665ff5c1fcc1168"
        }
      ],
      "source": {
        "advisory": "GHSA-ghr8-5898-6rjh",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Information disclosure in ajax.render.php"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33333",
    "datePublished": "2026-08-21T21:46:00.590Z",
    "dateReserved": "2026-03-18T22:15:11.812Z",
    "dateUpdated": "2026-08-21T21:46:00.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33240 (GCVE-0-2026-33240)

Vulnerability from cvelistv5 – Published: 2026-08-21 21:25 – Updated: 2026-08-21 21:25

Title

Combodo iTop: Reflected XSS in foreign key search criteria

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/2a16143e53…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:25:03.819Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-5hw5-fvw4-55p4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-5hw5-fvw4-55p4"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/2a16143e53b4019415db90b6ac89f16fc3f773ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/2a16143e53b4019415db90b6ac89f16fc3f773ff"
        }
      ],
      "source": {
        "advisory": "GHSA-5hw5-fvw4-55p4",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in foreign key search criteria"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33240",
    "datePublished": "2026-08-21T21:25:03.819Z",
    "dateReserved": "2026-03-18T02:42:27.508Z",
    "dateUpdated": "2026-08-21T21:25:03.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33047 (GCVE-0-2026-33047)

Vulnerability from cvelistv5 – Published: 2026-08-21 21:21 – Updated: 2026-08-21 21:42

Title

Combodo iTop: Object can be locked by a user without write permissions

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/28db230697…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33047",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:34:49.805883Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:42:15.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:21:53.846Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-3qpj-3fcg-f5jc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3qpj-3fcg-f5jc"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/28db23069732da5322a4dda821135519297e5c29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/28db23069732da5322a4dda821135519297e5c29"
        }
      ],
      "source": {
        "advisory": "GHSA-3qpj-3fcg-f5jc",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Object can be locked by a user without write permissions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33047",
    "datePublished": "2026-08-21T21:21:53.846Z",
    "dateReserved": "2026-03-17T18:10:50.211Z",
    "dateUpdated": "2026-08-21T21:42:15.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31936 (GCVE-0-2026-31936)

Vulnerability from cvelistv5 – Published: 2026-08-21 21:17 – Updated: 2026-08-21 21:17

Title

Combodo iTop: Unauthorized access to object information via search operation

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/b3223eb9b6…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:17:44.338Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-3r3r-j29m-3v43",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-3r3r-j29m-3v43"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/b3223eb9b6bc1514276f8f321db1e27db6f42808",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/b3223eb9b6bc1514276f8f321db1e27db6f42808"
        }
      ],
      "source": {
        "advisory": "GHSA-3r3r-j29m-3v43",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Unauthorized access to object information via search operation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31936",
    "datePublished": "2026-08-21T21:17:44.338Z",
    "dateReserved": "2026-03-10T15:10:10.654Z",
    "dateUpdated": "2026-08-21T21:17:44.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31880 (GCVE-0-2026-31880)

Vulnerability from cvelistv5 – Published: 2026-08-21 20:59 – Updated: 2026-08-21 21:42

Title

Combodo iTop: Reflected XSS in universal search

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/7bfa14a874…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31880",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:20:30.892496Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:42:30.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:59:35.991Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-6qgh-xqjr-4pv7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-6qgh-xqjr-4pv7"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/7bfa14a8744cc599caf0ed347022f8267793d6d9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/7bfa14a8744cc599caf0ed347022f8267793d6d9"
        }
      ],
      "source": {
        "advisory": "GHSA-6qgh-xqjr-4pv7",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in universal search"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31880",
    "datePublished": "2026-08-21T20:59:35.991Z",
    "dateReserved": "2026-03-09T21:59:02.686Z",
    "dateUpdated": "2026-08-21T21:42:30.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31803 (GCVE-0-2026-31803)

Vulnerability from cvelistv5 – Published: 2026-08-21 20:52 – Updated: 2026-08-21 21:42

Title

Combodo iTop: Reflected XSS in tag admin

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/ab8e7bd15e…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31803",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:20:33.487286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:42:37.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:52:09.233Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-m27p-8qgh-857g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-m27p-8qgh-857g"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/ab8e7bd15ed251ad4fbe8d4d1b17474b2d688fba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/ab8e7bd15ed251ad4fbe8d4d1b17474b2d688fba"
        }
      ],
      "source": {
        "advisory": "GHSA-m27p-8qgh-857g",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in tag admin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-31803",
    "datePublished": "2026-08-21T20:52:09.233Z",
    "dateReserved": "2026-03-09T16:33:42.913Z",
    "dateUpdated": "2026-08-21T21:42:37.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30890 (GCVE-0-2026-30890)

Vulnerability from cvelistv5 – Published: 2026-08-21 20:40 – Updated: 2026-08-21 20:40

Title

Combodo iTop: Reflected XSS in synchro/synchro_import.php

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/9236449b21…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:40:05.045Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-93q9-fc8m-5gp5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-93q9-fc8m-5gp5"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/9236449b218142207e2078ea6dc827637f722afc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/9236449b218142207e2078ea6dc827637f722afc"
        }
      ],
      "source": {
        "advisory": "GHSA-93q9-fc8m-5gp5",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in synchro/synchro_import.php"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30890",
    "datePublished": "2026-08-21T20:40:05.045Z",
    "dateReserved": "2026-03-06T00:04:56.700Z",
    "dateUpdated": "2026-08-21T20:40:05.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-30865 (GCVE-0-2026-30865)

Vulnerability from cvelistv5 – Published: 2026-08-21 20:37 – Updated: 2026-08-21 20:37

Title

Combodo iTop: Reflected XSS in dashboard save

Summary

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/Combodo/iTop/security/advisori…	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/330539abd2…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Combodo	iTop	Affected: < 3.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iTop",
          "vendor": "Combodo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:37:20.408Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-8j4q-ccr6-wpmj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-8j4q-ccr6-wpmj"
        },
        {
          "name": "https://github.com/Combodo/iTop/commit/330539abd22b1d4a00cfd698d17ee1c0ffa04da5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Combodo/iTop/commit/330539abd22b1d4a00cfd698d17ee1c0ffa04da5"
        }
      ],
      "source": {
        "advisory": "GHSA-8j4q-ccr6-wpmj",
        "discovery": "UNKNOWN"
      },
      "title": "Combodo iTop: Reflected XSS in dashboard save"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30865",
    "datePublished": "2026-08-21T20:37:20.408Z",
    "dateReserved": "2026-03-05T21:27:35.343Z",
    "dateUpdated": "2026-08-21T20:37:20.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

198 vulnerabilities found for itop by combodo

CVE-2026-34949 (GCVE-0-2026-34949)

CVE-2026-34948 (GCVE-0-2026-34948)

CVE-2026-34836 (GCVE-0-2026-34836)

CVE-2026-34741 (GCVE-0-2026-34741)

CVE-2026-33333 (GCVE-0-2026-33333)

CVE-2026-33240 (GCVE-0-2026-33240)

CVE-2026-33047 (GCVE-0-2026-33047)

CVE-2026-31936 (GCVE-0-2026-31936)

CVE-2026-31880 (GCVE-0-2026-31880)

CVE-2026-31803 (GCVE-0-2026-31803)

CVE-2026-30890 (GCVE-0-2026-30890)

CVE-2026-30865 (GCVE-0-2026-30865)

CVE-2026-30826 (GCVE-0-2026-30826)

CVE-2026-30866 (GCVE-0-2026-30866)

CVE-2026-30819 (GCVE-0-2026-30819)

CVE-2026-27490 (GCVE-0-2026-27490)

CVE-2026-27463 (GCVE-0-2026-27463)

CVE-2026-27462 (GCVE-0-2026-27462)

CVE-2026-34949 (GCVE-0-2026-34949)

CVE-2026-34948 (GCVE-0-2026-34948)

CVE-2026-34836 (GCVE-0-2026-34836)

CVE-2026-34741 (GCVE-0-2026-34741)

CVE-2026-33333 (GCVE-0-2026-33333)

CVE-2026-33240 (GCVE-0-2026-33240)

CVE-2026-33047 (GCVE-0-2026-33047)

CVE-2026-31936 (GCVE-0-2026-31936)

CVE-2026-31880 (GCVE-0-2026-31880)

CVE-2026-31803 (GCVE-0-2026-31803)

CVE-2026-30890 (GCVE-0-2026-30890)

CVE-2026-30865 (GCVE-0-2026-30865)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

198 vulnerabilities found for itop by combodo

CVE-2026-34949 (GCVE-0-2026-34949)

CVE-2026-34948 (GCVE-0-2026-34948)

CVE-2026-34836 (GCVE-0-2026-34836)

CVE-2026-34741 (GCVE-0-2026-34741)

CVE-2026-33333 (GCVE-0-2026-33333)

CVE-2026-33240 (GCVE-0-2026-33240)

CVE-2026-33047 (GCVE-0-2026-33047)

CVE-2026-31936 (GCVE-0-2026-31936)

CVE-2026-31880 (GCVE-0-2026-31880)

CVE-2026-31803 (GCVE-0-2026-31803)

CVE-2026-30890 (GCVE-0-2026-30890)

CVE-2026-30865 (GCVE-0-2026-30865)

CVE-2026-30826 (GCVE-0-2026-30826)

CVE-2026-30866 (GCVE-0-2026-30866)

CVE-2026-30819 (GCVE-0-2026-30819)

CVE-2026-27490 (GCVE-0-2026-27490)

CVE-2026-27463 (GCVE-0-2026-27463)

CVE-2026-27462 (GCVE-0-2026-27462)

CVE-2026-34949 (GCVE-0-2026-34949)

CVE-2026-34948 (GCVE-0-2026-34948)

CVE-2026-34836 (GCVE-0-2026-34836)

CVE-2026-34741 (GCVE-0-2026-34741)

CVE-2026-33333 (GCVE-0-2026-33333)

CVE-2026-33240 (GCVE-0-2026-33240)

CVE-2026-33047 (GCVE-0-2026-33047)

CVE-2026-31936 (GCVE-0-2026-31936)

CVE-2026-31880 (GCVE-0-2026-31880)

CVE-2026-31803 (GCVE-0-2026-31803)

CVE-2026-30890 (GCVE-0-2026-30890)

CVE-2026-30865 (GCVE-0-2026-30865)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.