CVE-2026-30865

Received Received - Intake

Reflected XSS in Combodo iTop Dashboard Save Functionality

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-30865

EUVD

EUVD-2026-64147

Affected Vendors & Products

Vendor	Product	Version / Range
combodo	itop	to 3.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Reflected Cross-Site Scripting (XSS) vulnerability in Combodo iTop, a web-based IT service management tool. It exists in the dashboard save functionality and allows attackers to inject malicious scripts that execute in a user's browser when they visit a specially crafted link.

Detection Guidance

To detect this vulnerability, check the version of Combodo iTop installed on your system. If it is below 3.2.3, the system is vulnerable. No specific commands are provided in the context for detection.

Impact Analysis

An attacker could exploit this to steal session cookies, perform actions on your behalf, or redirect you to malicious sites. It may lead to unauthorized data access or account compromise if you interact with a crafted link while logged into iTop.

Compliance Impact

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in Combodo iTop's dashboard save functionality. XSS vulnerabilities can allow attackers to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized data access or manipulation. This could impact compliance with GDPR by risking data confidentiality and integrity, and with HIPAA by potentially exposing protected health information if exploited.

Mitigation Strategies

Upgrade Combodo iTop to version 3.2.3 or later to address the Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality.

Hi! I’m here to help you understand CVE-2026-30865. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70