CVE-2025-47932High· 8.8▾ TwilightCombodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is rendered via an AJAX call. Versions 2.7.13 and 3.2.2 sanitize the var responsible for …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.2%
Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is rendered via an AJAX call. Versions 2.7.13 and 3.2.2 sanitize the var responsible for the attack.
itop < 2.7.13itop >= 3.0.0, < 3.2.2Upgrade past the affected range:
itop 3.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-48065High· 8.8Combodo iTop is a web based IT service management tool
CVE-2025-48055High· 8.5Combodo iTop is a web based IT service management tool
CVE-2025-47773High· 8.8Combodo iTop is a web based IT service management tool
CVE-2026-108717Medium· 6.3Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters
CVE-2025-48878Medium· 4.3Combodo iTop is a web based IT service management tool
CVE-2025-49145High· 8.7Combodo iTop is a web based IT service management tool