Reflected Cross-Site Scripting in Combodo iTop IT Service Management Tool

CVE-2026-30826

What is CVE-2026-30826?

Combodo iTop, a prominent web-based IT service management tool, is susceptible to a reflected Cross-Site Scripting (XSS) vulnerability in its testing OQL query functionality. This vulnerability allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to session hijacking, redirection to malicious sites, or data theft. The issue was present in versions prior to 3.2.3 and has been addressed in the latest update, ensuring enhanced security for users. Maintaining updated software versions is crucial to protect against such vulnerabilities.

References