CVE-2026-31803

Received Received - Intake

Reflected XSS in Combodo iTop

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-31803

EUVD

EUVD-2026-64084

Affected Vendors & Products

Vendor	Product	Version / Range
combodo	itop	to 3.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Reflected Cross-Site Scripting (XSS) vulnerability in Combodo iTop, a web-based IT service management tool. It exists in the pages/tagadmin.php file and allows attackers to inject malicious scripts into web pages viewed by users. The issue was fixed in version 3.2.3.

Detection Guidance

This vulnerability is specific to Combodo iTop versions prior to 3.2.3 and involves a reflected XSS in pages/tagadmin.php. Detection requires checking the iTop version installed on your system. If you are running a version earlier than 3.2.3, the system is vulnerable. No specific network or system commands are provided in the context to detect this vulnerability.

Impact Analysis

An attacker could exploit this to steal user sessions, redirect users to malicious sites, or perform actions on behalf of users. It requires user interaction, such as clicking a crafted link, but could lead to unauthorized access or data theft if exploited.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may risk protected health information exposure. Both standards require protecting against such vulnerabilities to maintain compliance.

Mitigation Strategies

Immediately upgrade Combodo iTop to version 3.2.3 or later to address the reflected XSS vulnerability in pages/tagadmin.php. Ensure no custom or outdated versions are running on your systems.

Hi! I’m here to help you understand CVE-2026-31803. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70