CVE-2024-51994

Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting (XSS) vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79
• CWE-79

• https://github.com/Combodo/iTop/security/advisories/GHSA-jjph-c25g-5c7gVendor Advisory

Published

Nov 7, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-51989Password Pusher is an open source application to communicate…7.1
• CVE-2024-5199The Spotify Play Button WordPress plugin through 1.0 does no…5.4
• CVE-2024-51990jj, or Jujutsu, is a Git-compatible VCS written in rust. In …9.3
• CVE-2024-51991October is a Content Management System (CMS) and web platfor…4.9
• CVE-2024-51992Orchid is a @laravel package that allows for rapid applicati…4.1
• CVE-2024-51993Combodo iTop is a web based IT Service Management tool. An a…3.4
• CVE-2024-51995Combodo iTop is a web based IT Service Management tool. An a…7.1
• CVE-2024-51996Symphony process is a module for the Symphony PHP framework …7.5
• CVE-2024-51997Trustee is a set of tools and components for attesting confi…8.1
• CVE-2024-51998changedetection.io is a free open source web page change det…8.6
• CVE-2024-51999Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-5200The Postie WordPress plugin before 1.9.71 does not sanitise …4.8