Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

iTop — Vulnerabilities & Security Advisories 87

All 87 CVE vulnerabilities found in iTop, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting iTop, a web-based project management system, with a primary focus on common weakness types such as cross-site scripting, SQL injection, and authentication bypass. It collects all publicly disclosed advisories for iTop across its entire release history, covering known defects and their associated Common Vulnerabilities and Exposures. Readers can use this section to track a vendor’s security posture, understand the prevalence of specific weakness classes, and review the complete vulnerability history for the iTop product line.

Vendor: Combodo

CVE ID Title CVSS Severity Published
CVE-2025-24785 iTop dashboard vulnerable to denial of service CWE-20 4.3 Medium 2025-05-14
CVE-2025-24026 iTop Inefficient Regular Expression Complexity vulnerability CWE-1333 5.3 Medium 2025-05-14
CVE-2025-24022 iTop server vulnerable to portal code injection CWE-78 8.6 High 2025-05-14
CVE-2025-24021 iTop doesn't have mass assignment of fields in the portal form CWE-862 5.0 Medium 2025-05-14
CVE-2024-56157 iTop vulnerable to Self XSS in CSV Import CWE-79 6.3 Medium 2025-05-14
CVE-2024-52601 iTop portal Insecure Direct Object Reference vulnerability CWE-639 6.5 Medium 2025-05-14
CVE-2025-27139 Combodo iTop vulnerable to stored self Cross-site Scripting in preferences CWE-79 6.8 Medium 2025-02-25
CVE-2024-54139 Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter CWE-79 7.9 High 2024-12-13
CVE-2024-52000 Reflected Cross-site Scripting exploit in Combodo iTop CWE-79 6.1 - 2024-11-08
CVE-2024-52001 Portal user is able to access forbidden services information in Combodo iTop CWE-200 4.3 - 2024-11-08
CVE-2024-52002 Cross-Site Request Forgery (CSRF) in several iTop pages CWE-352 8.8 - 2024-11-08
CVE-2024-51993 Password is stored in clear in the database in Combodo iTop CWE-312 6.5AI Medium AI 2024-11-07
CVE-2024-51994 Cross-site Scripting in portal picture upload in Combodo iTop CWE-79 5.4AI Medium AI 2024-11-07
CVE-2024-51995 Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop CWE-284 7.5AI High AI 2024-11-07
CVE-2024-51740 SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop CWE-918 4.3 Medium 2024-11-05
CVE-2024-51739 Users enumeration allowed through Rest API in Combodo iTop CWE-200 7.5 High 2024-11-05
CVE-2024-32870 iTop hub connector Information disclosure CWE-200 5.8 Medium 2024-11-04
CVE-2024-31998 CSRF security issue on CSV import in Combodo iTop CWE-352 8.8 High 2024-11-04
CVE-2024-31448 Cross-site Scripting vulnerability in link CSV import in Combodo iTop CWE-79 8.8 High 2024-11-04
CVE-2023-34445 Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTop CWE-79 8.8 High 2024-11-04
CVE-2023-34444 Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop CWE-79 8.8 High 2024-11-04
CVE-2023-34443 Cross-site Scripting vulnerability in the run_query.php page in Combodo iTop CWE-79 8.8 High 2024-11-04
CVE-2023-48710 iTop limit pages/exec.php script to PHP files CWE-552 9.8 Critical 2024-04-15
CVE-2023-48709 iTop vulnerable to potential formula injection in Excel/CSV export file CWE-1236 8.0 High 2024-04-15
CVE-2023-47626 iTop vulnerable to XSS vulnerability in authent-token CWE-79 8.8 High 2024-04-15
CVE-2023-47622 iTop vulnerable to XSS vulnerability in dashlet refresh CWE-79 8.8 High 2024-04-15
CVE-2023-47123 iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget CWE-79 8.7 High 2024-04-15
CVE-2023-45808 iTop missing silo check on extkey in console and portal CWE-639 4.1 Medium 2024-04-15
CVE-2023-44396 iTop vulnerable to XSS in dashlet modifications ajax endpoints CWE-79 6.8 Medium 2024-04-15
CVE-2023-43790 iTop vulnerable to XSS in friendlyname in object details CWE-79 5.7 Medium 2024-04-15

All 87 known CVE vulnerabilities affecting iTop with full Chinese analysis, references, and POCs where available.