CVE-2026-30819

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3

Description Combodo iTop contains a reflected Cross-Site Scripting (XSS) flaw in its dashboard revert functionality. The issue occurs when the application fails to properly sanitize the dashboard id variable within the '/pages/ajax.render.php' endpoint. Cross-Site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users.

Recommendations Update to version 3.2.3. Avoid using the dashboard id parameter in the '/pages/ajax.render.php' endpoint until the update is applied.