CVE-2026-34741

Publié : 21 août 2026

Modifié : 21 août 2026

Score CVSS

8.6

HIGH

Description détaillée

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Références et Patchs

https://github.com/Combodo/iTop/commit/4fe61cbdc779cb5576395d4ae8be31f9fbc7306c https://github.com/Combodo/iTop/security/advisories/GHSA-36h9-5qw2-jcc6

Dernières Vulnérabilités

CVE-2026-77781

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies. An application that looks up externally supplied strings in a tied hash will die on an invalid key.

VOIR DÉTAILS

CVE-2026-9052

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-76069

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS