CVEs we hold for Combodo
Records whose assigning authority named Combodo as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-40877Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferencesCombodo iTop CVE-2026-39975Combodo iTop: Remote code execution using external auth variable valueCombodo iTop CVE-2026-34949Combodo iTop: Unauthenticated user can delete .readonly fileCombodo iTop CVE-2026-34948Combodo iTop: Access control bypass via OQL joinsCombodo iTop CVE-2026-34836Combodo iTop: Improper access control in ajax.render.php and ajax.document.phpCombodo iTop CVE-2026-34741Combodo iTop: Authentication bypass in exec.php allows PHP file executionCombodo iTop CVE-2026-33333Combodo iTop: Information disclosure in ajax.render.phpCombodo iTop CVE-2026-33240Combodo iTop: Reflected XSS in foreign key search criteriaCombodo iTop CVE-2026-33047Combodo iTop: Object can be locked by a user without write permissionsCombodo iTop CVE-2026-31936Combodo iTop: Unauthorized access to object information via search operationCombodo iTop CVE-2026-31880Combodo iTop: Reflected XSS in universal searchCombodo iTop CVE-2026-30890Combodo iTop: Reflected XSS in synchro/synchro_import.phpCombodo iTop CVE-2026-30866Combodo iTop: Insecured access to uploaded images via sniffed urlCombodo iTop CVE-2026-30865Combodo iTop: Reflected XSS in dashboard saveCombodo iTop CVE-2026-30864Combodo iTop: Reflected XSS in dashboard revertCombodo iTop CVE-2026-30826Combodo iTop: Reflected XSS in run_query.phpCombodo iTop CVE-2026-30819Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameterCombodo iTop CVE-2026-27490Combodo iTop: Weak secret generation for inline imageCombodo iTop CVE-2026-27463Combodo iTop: Version disclosure via login page logoCombodo iTop CVE-2026-27462Combodo iTop: User enumeration via password resetCombodo iTop CVE-2025-64167Combodo iTop vulnerable to reflected XSS in webservices/export.phpCombodo iTop CVE-2025-49145iTop admin can drop iTop database using webhooksCombodo iTop CVE-2025-48878Combodo iTop vulnerable to IDOR with ModuleInstallation objectCombodo iTop CVE-2025-48065Combodo iTop vulnerable to reflected XSS via objection edition form errorCombodo iTop CVE-2025-48055Combodo iTop has stored XSS in user portal's browse brickCombodo iTop CVE-2025-47932Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboardCombodo iTop CVE-2025-47773Combodo iTop has XSS vulnerability in /pages/ajax.render.phpCombodo iTop CVE-2025-47286Combodo iTop vulnerable to Remote Code Execution in the backup creation functionalityCombodo iTop CVE-2025-27139Combodo iTop vulnerable to stored self Cross-site Scripting in preferencesCombodo iTop CVE-2025-24969iTop portal user can see any other contact's pictureCombodo iTop CVE-2025-24785iTop dashboard vulnerable to denial of serviceCombodo iTop CVE-2025-24026iTop Inefficient Regular Expression Complexity vulnerabilityCombodo iTop CVE-2025-24022iTop server vulnerable to portal code injectionCombodo iTop CVE-2025-24021iTop doesn't have mass assignment of fields in the portal formCombodo iTop CVE-2024-54139Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameterCombodo iTop CVE-2024-52601iTop portal Insecure Direct Object Reference vulnerabilityCombodo iTop CVE-2024-52002Cross-Site Request Forgery (CSRF) in several iTop pagesCombodo iTop CVE-2024-52001Portal user is able to access forbidden services information in Combodo iTopCombodo iTop CVE-2024-52000Reflected Cross-site Scripting exploit in Combodo iTopCombodo iTop CVE-2024-51995Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTopCombodo iTop CVE-2024-51994Cross-site Scripting in portal picture upload in Combodo iTopCombodo iTop CVE-2024-51993Password is stored in clear in the database in Combodo iTopCombodo iTop CVE-2024-51740SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTopCombodo iTop CVE-2024-51739Users enumeration allowed through Rest API in Combodo iTopCombodo iTop CVE-2024-31998CSRF security issue on CSV import in Combodo iTopCombodo iTop CVE-2024-31448Cross-site Scripting vulnerability in link CSV import in Combodo iTopCombodo iTop CVE-2023-48710iTop limit pages/exec.php script to PHP filesCombodo iTop CVE-2023-48709iTop vulnerable to potential formula injection in Excel/CSV export fileCombodo iTop CVE-2023-47626iTop vulnerable to XSS vulnerability in authent-tokenCombodo iTop CVE-2023-47622iTop vulnerable to XSS vulnerability in dashlet refreshCombodo iTop CVE-2023-47123iTop vulnerable to XSS vulnerability in n:n relations "tagset" widgetCombodo iTop CVE-2023-45808iTop missing silo check on extkey in console and portalCombodo iTop CVE-2023-44396iTop vulnerable to XSS in dashlet modifications ajax endpointsCombodo iTop CVE-2023-43790iTop vulnerable to XSS in friendlyname in object detailsCombodo iTop CVE-2023-38511iTop Dashboard editor vulnerable dashboard config file parameterCombodo iTop CVE-2023-34446iTop XSS vulnerability on pages/preferences.phpCombodo iTop CVE-2023-34445Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTopCombodo iTop CVE-2023-34444Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTopCombodo iTop CVE-2023-34443Cross-site Scripting vulnerability in the run_query.php page in Combodo iTopCombodo iTop CVE-2022-39216Combodo iTop's weak password reset token leads to account takeoverCombodo iTop CVE-2022-39214Authenticated users of Combodo iTop can take over any accountCombodo iTop CVE-2021-41245Possible Cross-Site Request Forgery in Combodo iTopCombodo iTop CVE-2021-32776No CSRF form token cleanup on Windows serversCombodo iTop CVE-2021-32775Any user can see any fields (including mailbox password) with GroupBy DashletCombodo iTop CVE-2021-32663Unauthorized setup leads to SSRF in Combodo/iTopCombodo iTop CVE-2021-21406Command Injection vulnerability in the Setup WizardCombodo iTop CVE-2020-4079Information disclosure vulnerability in iTopCombodo iTop 87 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.