CVE-2025-48065

MediumCVSS 6.1/10Last modified Oct 7, 2026

Description

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 10, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-480665.5wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function CVE-2025-480674.6OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerab CVE-2025-480684.3Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before CVE-2025-480696.6ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a CVE-2025-48077.5A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unkno CVE-2025-480704.3Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to ch CVE-2025-480717.8OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus CVE-2025-480729.1OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus CVE-2025-480736.2OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus CVE-2025-480745.5OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus CVE-2025-480757.5Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can CVE-2025-480765.4Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group nam