CVE-2025-47773

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.13 Combodo iTop versions prior to 3.2.2

Description Combodo iTop, a web-based IT service management tool, is susceptible to cross-site scripting when a dashboard is edited through an AJAX call. This allows for the injection and execution of malicious scripts within a user's browser. The API endpoint involved in this issue is the dashboard editing functionality accessed via AJAX calls. The vulnerable operation involves editing a dashboard.

Recommendations Update to Combodo iTop version 2.7.13 or later. Update to Combodo iTop version 3.2.2 or later.