CVE-2021-41161

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411626.1Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` CVE-2021-411639.8Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code e CVE-2021-411645.4CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (AC CVE-2021-411655.4CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module CVE-2021-411665.3The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may CVE-2021-411677.5modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a CVE-2021-411686.5Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown CVE-2021-411694.8Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross s CVE-2021-41174.3yetiforcecrm is vulnerable to Business Logic Errors CVE-2021-411709.8neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the tem CVE-2021-411718.8eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to by CVE-2021-411725.4AS_Redis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to