CVE-2025-48055High· 8.5▾ TwilightCombodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.
itop < 3.2.2Upgrade past the affected range:
itop 3.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-48065High· 8.8Combodo iTop is a web based IT service management tool
CVE-2025-47932High· 8.8Combodo iTop is a web based IT service management tool
CVE-2025-47773High· 8.8Combodo iTop is a web based IT service management tool
CVE-2025-48878Medium· 4.3Combodo iTop is a web based IT service management tool
CVE-2025-49145High· 8.7Combodo iTop is a web based IT service management tool
CVE-2025-47286High· 7.2Combodo iTop is a web based IT service management tool