CVE-2021-32664: Combodo Itop

Medium severity, CVSS 4.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.

Affected products

• Combodo Itop: before 2.6.5 (fixed in 2.6.5); from 2.7.0, before 2.7.5 (fixed in 2.7.5)

Published 2021-10-19. Last modified 2026-06-17.