Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

iTop — Vulnerabilities & Security Advisories 87

All 87 CVE vulnerabilities found in iTop, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting iTop, a web-based project management system, with a primary focus on common weakness types such as cross-site scripting, SQL injection, and authentication bypass. It collects all publicly disclosed advisories for iTop across its entire release history, covering known defects and their associated Common Vulnerabilities and Exposures. Readers can use this section to track a vendor’s security posture, understand the prevalence of specific weakness classes, and review the complete vulnerability history for the iTop product line.

Vendor: Combodo

CVE ID Title CVSS Severity Published
CVE-2023-38511 iTop Dashboard editor vulnerable dashboard config file parameter CWE-22 5.0 Medium 2024-04-15
CVE-2023-34447 iTop XSS vulnerability on pages/UI.php CWE-79 8.8 High 2023-10-25
CVE-2023-34446 iTop XSS vulnerability on pages/preferences.php CWE-79 8.8 High 2023-10-25
CVE-2022-39216 Combodo iTop's weak password reset token leads to account takeover CWE-330 7.4 High 2023-03-14
CVE-2022-39214 Authenticated users of Combodo iTop can take over any account CWE-863 9.6 Critical 2023-03-14
CVE-2021-41162 Cross-site Scripting in Combodo iTop CWE-79 9.3 Critical 2022-04-21
CVE-2022-24870 Stored Cross-site Scripting in Combodo iTop CWE-79 8.7 High 2022-04-21
CVE-2021-41161 XSS in csvimport in 3.0.0-beta versions CWE-79 9.3 Critical 2022-04-21
CVE-2022-24811 Cross-site Scripting in Combodo iTop CWE-79 5.4 Medium 2022-04-05
CVE-2022-24780 Code Injection in Combodo iTop CWE-94 8.8 High 2022-04-05
CVE-2021-41245 Possible Cross-Site Request Forgery in Combodo iTop CWE-352 6.5 Medium 2022-04-05
CVE-2021-32664 Reflected XSS in Combodo/iTop CWE-79 8.1 High 2021-10-19
CVE-2021-32663 Unauthorized setup leads to SSRF in Combodo/iTop CWE-918 8.7 High 2021-10-19
CVE-2021-32776 No CSRF form token cleanup on Windows servers CWE-352 6.8 Medium 2021-07-21
CVE-2021-32775 Any user can see any fields (including mailbox password) with GroupBy Dashlet CWE-209 7.7 High 2021-07-21
CVE-2021-21407 Portal : the CSRF token isn't validated CWE-352 8.0 High 2021-07-21
CVE-2021-21406 Command Injection vulnerability in the Setup Wizard CWE-77 5.8 Medium 2021-07-21
CVE-2020-15221 XSS in the breadcrumbs CWE-79 6.8 Medium 2021-01-13
CVE-2020-15220 Session fixation CWE-613 6.1 Medium 2021-01-13
CVE-2020-15219 SQL query displayed on portal error CWE-209 4.3 Medium 2021-01-13
CVE-2020-15218 Admin pages are cached and can be embedded CWE-613 6.8 Medium 2021-01-13
CVE-2020-4079 Information disclosure vulnerability in iTop CWE-200 7.7 High 2021-01-12
CVE-2020-12781 Combodo iTop - CSRF CWE-352 5.7 Medium 2020-08-10
CVE-2020-12780 Combodo iTop - Security Misconfiguration 7.5 High 2020-08-10
CVE-2020-12779 Combodo iTop - Stored XSS 6.8 Medium 2020-08-10
CVE-2020-12777 Combodo iTop - Broken Access Control 7.5 High 2020-08-10
CVE-2020-12778 Combodo iTop - Reflected XSS 7.4 High 2020-08-10

All 87 known CVE vulnerabilities affecting iTop with full Chinese analysis, references, and POCs where available.