Combodo records

82 published records for vendor combodo.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 2
With a fix record: 18.3%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

82 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2022-39216No exploit	Combodo iTop's weak password reset token leads to account takeovercombodo · itop · CWE-330 Pre-auth Weak crypto	Critical9.8	—	0.9%	Mar 14, 2023
39Monitor	CVE-2023-48710No exploit	iTop limit pages/exec.php script to PHP filescombodo · itop · CWE-552 Pre-auth	Critical9.8	—	0.7%	Apr 15, 2024
38Monitor	CVE-2022-39214No exploit	Authenticated users of Combodo iTop can take over any accountcombodo · itop · CWE-863 Broken access control (IDOR)	High7.5	—	25.6%	Mar 14, 2023
38Monitor	CVE-2024-54139No exploit	Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parametercombodo · itop · CWE-79 Pre-auth XSS CSRF	Critical9.6	—	0.2%	Dec 13, 2024
37Monitor	CVE-2022-24780Proof of concept	Code Injection in Combodo iTopcombodo · itop · CWE-94 RCE	High8.8	—	5.7%	Apr 5, 2022
35Monitor	CVE-2021-21406No exploit	Command Injection vulnerability in the Setup Wizardcombodo · itop · CWE-77 RCE Command injection	High8.8	—	1.0%	Jul 21, 2021
35Monitor	CVE-2024-52002Proof of concept	Cross-Site Request Forgery (CSRF) in several iTop pagescombodo · itop · CWE-352 Pre-auth CSRF	High8.8	—	0.7%	Nov 8, 2024
35Monitor	CVE-2024-51740No exploit	SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTopcombodo · itop · CWE-918 SSRF	High8.8	—	0.5%	Nov 5, 2024
35Monitor	CVE-2020-12781No exploit	Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request combodo · itop · CWE-352 Pre-auth CSRF	High8.8	—	0.5%	Aug 9, 2020
35Monitor	CVE-2021-32776No exploit	No CSRF form token cleanup on Windows serverscombodo · itop · CWE-352 Pre-auth CSRF	High8.8	—	0.4%	Jul 21, 2021
35Monitor	CVE-2024-31998No exploit	CSRF security issue on CSV import in Combodo iTopcombodo · itop · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Nov 4, 2024
34Monitor	CVE-2025-24022No exploit	iTop server vulnerable to portal code injectioncombodo · itop · CWE-78 RCE Command injection	High8.5	—	0.6%	May 14, 2025
34Monitor	CVE-2025-47286No exploit	Combodo iTop vulnerable to Remote Code Execution in the backup creation functionalitycombodo · itop · CWE-74 RCE	High8.6	—	0.5%	Nov 10, 2025
32Monitor	CVE-2019-10863Proof of concept	A command injection vulnerability exists in TeemIp versions before 2.4.0.combodo · teemip · CWE-94 RCE Command injection	High7.2	—	13.4%	Apr 4, 2019
32Monitor	CVE-2019-19821No exploit	A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information acombodo · itop · CWE-79 XSS	High8.1	—	1.4%	Mar 16, 2020
32Monitor	CVE-2019-11215No exploit	In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling combodo · itop · CWE-79 pre-auth RCE XSS Race condition	High8.1	—	1.2%	Feb 14, 2020
32Monitor	CVE-2023-48709No exploit	iTop vulnerable to potential formula injection in Excel/CSV export filecombodo · itop · CWE-74 RCE	High8.0	—	1.0%	Apr 15, 2024
32Monitor	CVE-2021-41245No exploit	Possible Cross-Site Request Forgery in Combodo iTopcombodo · itop · CWE-352 Pre-auth CSRF	High8.1	—	0.7%	Apr 5, 2022
31Monitor	CVE-2023-47489No exploit	CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to thecombodo · itop RCE	High7.8	—	0.4%	Nov 9, 2023
30Monitor	CVE-2018-10642No exploit	Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing tcombodo · itop · CWE-94 RCE Command injection	High7.2	—	7.4%	May 2, 2018
30Monitor	CVE-2021-32663No exploit	Unauthorized setup leads to SSRF in Combodo/iTopcombodo · itop · CWE-918 Pre-auth Auth bypass SSRF	High7.5	—	1.5%	Oct 19, 2021
30Monitor	CVE-2019-13967No exploit	iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile opecombodo · itop Pre-auth Denial of service	High7.5	—	1.3%	Feb 14, 2020
30Monitor	CVE-2020-12777No exploit	Combodo iTop - Broken Access Controlcombodo · itop · CWE-200 Pre-auth Broken access control (IDOR) Info leak	High7.5	—	1.3%	Aug 9, 2020
30Monitor	CVE-2020-12780No exploit	Combodo iTop - Security Misconfigurationcombodo · itop · CWE-863 Pre-auth Broken access control (IDOR)	High7.5	—	1.2%	Aug 9, 2020
30Monitor	CVE-2020-4079No exploit	Information disclosure vulnerability in iTopcombodo · itop · CWE-200 Info leak	High7.7	—	0.9%	Jan 12, 2021

CVE-2022-39216
39Monitor
Combodo iTop's weak password reset token leads to account takeover
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Weak crypto
combodo · itopMar 14, 2023
CVE-2023-48710
39Monitor
iTop limit pages/exec.php script to PHP files
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
combodo · itopApr 15, 2024
CVE-2022-39214
38Monitor
Authenticated users of Combodo iTop can take over any account
HighCVSS 7.5No exploitEPSS 26%
- Broken access control (IDOR)
combodo · itopMar 14, 2023
CVE-2024-54139
38Monitor
Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- XSS
- CSRF
combodo · itopDec 13, 2024
CVE-2022-24780
37Monitor
Code Injection in Combodo iTop
HighCVSS 8.8Proof of conceptEPSS 6%
- RCE
combodo · itopApr 5, 2022
CVE-2021-21406
35Monitor
Command Injection vulnerability in the Setup Wizard
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
combodo · itopJul 21, 2021
CVE-2024-52002
35Monitor
Cross-Site Request Forgery (CSRF) in several iTop pages
HighCVSS 8.8Proof of conceptEPSS 1%
- Pre-auth
- CSRF
combodo · itopNov 8, 2024
CVE-2024-51740
35Monitor
SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop
HighCVSS 8.8No exploitEPSS 1%
- SSRF
combodo · itopNov 5, 2024
CVE-2020-12781
35Monitor
Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
combodo · itopAug 9, 2020
CVE-2021-32776
35Monitor
No CSRF form token cleanup on Windows servers
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
combodo · itopJul 21, 2021
CVE-2024-31998
35Monitor
CSRF security issue on CSV import in Combodo iTop
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
combodo · itopNov 4, 2024
CVE-2025-24022
34Monitor
iTop server vulnerable to portal code injection
HighCVSS 8.5No exploitEPSS 1%
- RCE
- Command injection
combodo · itopMay 14, 2025
CVE-2025-47286
34Monitor
Combodo iTop vulnerable to Remote Code Execution in the backup creation functionality
HighCVSS 8.6No exploitEPSS 0%
- RCE
combodo · itopNov 10, 2025
CVE-2019-10863
32Monitor
A command injection vulnerability exists in TeemIp versions before 2.4.0.
HighCVSS 7.2Proof of conceptEPSS 13%
- RCE
- Command injection
combodo · teemipApr 4, 2019
CVE-2019-19821
32Monitor
A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information a
HighCVSS 8.1No exploitEPSS 1%
- XSS
combodo · itopMar 16, 2020
CVE-2019-11215
32Monitor
In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling
HighCVSS 8.1No exploitEPSS 1%
- pre-auth RCE
- XSS
- Race condition
combodo · itopFeb 14, 2020
CVE-2023-48709
32Monitor
iTop vulnerable to potential formula injection in Excel/CSV export file
HighCVSS 8.0No exploitEPSS 1%
- RCE
combodo · itopApr 15, 2024
CVE-2021-41245
32Monitor
Possible Cross-Site Request Forgery in Combodo iTop
HighCVSS 8.1No exploitEPSS 1%
- Pre-auth
- CSRF
combodo · itopApr 5, 2022
CVE-2023-47489
31Monitor
CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the
HighCVSS 7.8No exploitEPSS 0%
- RCE
combodo · itopNov 9, 2023
CVE-2018-10642
30Monitor
Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing t
HighCVSS 7.2No exploitEPSS 7%
- RCE
- Command injection
combodo · itopMay 2, 2018
CVE-2021-32663
30Monitor
Unauthorized setup leads to SSRF in Combodo/iTop
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Auth bypass
- SSRF
combodo · itopOct 19, 2021
CVE-2019-13967
30Monitor
iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile ope
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
combodo · itopFeb 14, 2020
CVE-2020-12777
30Monitor
Combodo iTop - Broken Access Control
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
- Info leak
combodo · itopAug 9, 2020
CVE-2020-12780
30Monitor
Combodo iTop - Security Misconfiguration
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
combodo · itopAug 9, 2020
CVE-2020-4079
30Monitor
Information disclosure vulnerability in iTop
HighCVSS 7.7No exploitEPSS 1%
- Info leak
combodo · itopJan 12, 2021