# Combodo Itop


- [CVE-2023-48710](https://insights.sbomify.com/CVE-2023-48710/): iTop limit pages/exec.php script to PHP files (critical 9.8)
- [CVE-2022-39214](https://insights.sbomify.com/CVE-2022-39214/): Authenticated users of Combodo iTop can take over any account (critical 9.6)
- [CVE-2021-41161](https://insights.sbomify.com/CVE-2021-41161/): XSS in csvimport in 3.0.0-beta versions (critical 9.3)
- [CVE-2021-41162](https://insights.sbomify.com/CVE-2021-41162/): Cross-site Scripting in Combodo iTop (critical 9.3)
- [CVE-2025-47773](https://insights.sbomify.com/CVE-2025-47773/): Combodo iTop has XSS vulnerability in /pages/ajax.render.php (high 8.8)
- [CVE-2025-47932](https://insights.sbomify.com/CVE-2025-47932/): Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard (high 8.8)
- [CVE-2025-48065](https://insights.sbomify.com/CVE-2025-48065/): Combodo iTop vulnerable to reflected XSS via objection edition form error (high 8.8)
- [CVE-2023-34443](https://insights.sbomify.com/CVE-2023-34443/): Cross-site Scripting vulnerability in the run_query.php page in Combodo iTop (high 8.8)
- [CVE-2023-34444](https://insights.sbomify.com/CVE-2023-34444/): Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop (high 8.8)
- [CVE-2023-34445](https://insights.sbomify.com/CVE-2023-34445/): Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTop (high 8.8)
- [CVE-2024-31448](https://insights.sbomify.com/CVE-2024-31448/): Cross-site Scripting vulnerability in link CSV import in Combodo iTop (high 8.8)
- [CVE-2024-31998](https://insights.sbomify.com/CVE-2024-31998/): CSRF security issue on CSV import in Combodo iTop (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/combodo/itop/