74
CVEs
2
Critical
37
High
0
KEV
9
PoC
21
Unpatched C/H
37.8%
Patch Rate
0.8%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
37
MEDIUM
33
LOW
2
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2022-24780 | Combodo iTop is a web based IT Service Management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | HIGH | 8.8 | 5.3% | 64 |
PoC
|
| CVE-2018-10642 | Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.2 | 7.5% | 56 |
PoC
No patch
|
| CVE-2019-10863 | A command injection vulnerability exists in TeemIp versions before 2.4.0. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.2 | 13.4% | 56 |
PoC
No patch
|
| CVE-2022-31402 | ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 2.2% | 50 |
PoC
No patch
|
| CVE-2022-31403 | ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 1.7% | 50 |
PoC
No patch
|
| CVE-2024-32870 | Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | MEDIUM | 5.8 | 0.7% | 49 |
PoC
No patch
|
| CVE-2024-54139 | Combodo iTop is an open source and web-based IT service management platform. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.6 | 0.2% | 48 |
No patch
|
| CVE-2026-39975 | Unauthenticated code execution in Combodo iTop before 3.2.3 arises because remote users can delete the setup-generated .readonly lockfile, which is the guard that blocks write operations and, once removed, re-opens privileged setup/configuration paths that lead to arbitrary code execution (CWE-94). Any internet-reachable iTop instance below 3.2.3 is affected, and the flaw carries a CVSS 4.0 score of 9.4 with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial precondition (a single unauthenticated file-deletion request) makes weaponization realistic. | CRITICAL | 9.4 | 0.3% | 47 |
|
| CVE-2022-24811 | Combodi iTop is a web based IT Service Management tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | MEDIUM | 5.4 | 0.7% | 47 |
PoC
|
| CVE-2022-24870 | Combodo iTop is a web based IT Service Management tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | MEDIUM | 5.4 | 0.9% | 47 |
PoC
|
| CVE-2024-51739 | Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | MEDIUM | 5.3 | 1.3% | 46 |
PoC
No patch
|
| CVE-2026-30864 | Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated attacker to inject malicious scripts via the dashboard revert functionality, executing arbitrary JavaScript in a victim's browser session within the iTop context. The CVSS 8.9 score and Changed scope (S:C) reflect that successful exploitation extends impact beyond the iTop application itself - enabling session hijacking, credential theft, or privilege escalation on behalf of the victim user. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.9 | 0.2% | 45 |
|
| CVE-2026-33240 | Reflected XSS in Combodo iTop's foreign key search criteria API (all versions prior to 3.2.3) enables remote attackers to execute arbitrary JavaScript in the browser context of authenticated iTop users by delivering a crafted URL. The CVSS 8.8 rating reflects low attack complexity and high impact on confidentiality, integrity, and availability within the ITSM platform's session context. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patch 3.2.3 is available. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-31936 | Missing object-level authorization in Combodo iTop prior to 3.2.3 allows authenticated users to retrieve IT management objects outside their permitted access scope via the search interface. The flaw resides in AjaxRenderController::GetDataForTable(), which returned DBObjectSet results without calling UserRights::IsActionAllowed() - confirmed by the fix commit. No public exploit has been identified at time of analysis, but the low-privilege, network-accessible attack path makes this a credible threat for any multi-tenant or role-segmented iTop deployment. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2020-12781 | Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.5% | 44 |
No patch
|