CVE-2024-51994

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting (XSS) vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-519957.1Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` tha CVE-2024-519967.5Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me CVE-2024-519978.1Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Tok CVE-2024-519988.6changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in CVE-2024-52004.8The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-520006.1Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) expl CVE-2024-520014.3Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services info CVE-2024-520028.8Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vul CVE-2024-520036.1Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provi CVE-2024-520048.7MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnera CVE-2024-520058.8Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported CVE-2024-520067.5Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and