CVE-2025-49145

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Combodo	iTop	< 2.7.13; >= 3.0.0-alpha, < 3.2.2

References

https://github.com/Combodo/iTop/security/advisories/GHSA-55q8-mfxr-pq4jVendor Advisory

Timeline

Published: Nov 10, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-491465.9pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel bi CVE-2025-491475.3Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13 CVE-2025-491487.3ClipShare is a lightweight and cross-platform tool for clipboard sharing. Prior to 3.8.5, ClipShare Server for Windows uses the default Wind CVE-2025-491496.1Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. At CVE-2025-49159.8A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been declared as critical. This vulnerability affects CVE-2025-491505.9Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. CVE-2025-491519.3The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens (JWT) to bypass authentication.CVE-2025-491528.7The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system.CVE-2025-491539.3The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code.CVE-2025-491547.8An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker t CVE-2025-491558.8An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject maliciou CVE-2025-491567.8A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected ins