CVE-2025-49145High· 8.7▾ TwilightCombodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by veri…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.
itop < 2.7.13itop >= 3.0.0, < 3.2.2Upgrade past the affected range:
itop 3.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108717Medium· 6.3Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters
CVE-2025-48065High· 8.8Combodo iTop is a web based IT service management tool
CVE-2025-48878Medium· 4.3Combodo iTop is a web based IT service management tool
CVE-2025-47932High· 8.8Combodo iTop is a web based IT service management tool
CVE-2025-48055High· 8.5Combodo iTop is a web based IT service management tool
CVE-2025-47286High· 7.2Combodo iTop is a web based IT service management tool