CVE-2025-27139

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting when the preferences page is opened. Versions 2.7.12, 3.1.2, and 3.2.0 fix the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-27144.3A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functi CVE-2025-271409.8WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the CVE-2025-271416.5Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.4 CVE-2025-271428.8LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network wit CVE-2025-271436.1Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open CVE-2025-271446.6Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web En CVE-2025-271456.1copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is con CVE-2025-271464.3matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability whic CVE-2025-271478.2The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deploym CVE-2025-271488.8Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system tem CVE-2025-271492.7Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization CVE-2025-27153.5A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file