PT-2025-46196 · Comodo+1 · Itop+1

Published 2025-11-10 · Updated 2026-02-24 · CVE-2025-49145

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.13 Combodo iTop versions prior to 3.2.2

Description Combodo iTop is a web-based IT service management tool. A user with sufficient privileges to create webhooks (typically administrators) can drop the database. This occurs because the callback signature is not verified.

Recommendations Update to iTop version 2.7.13. Update to iTop version 3.2.2.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-49145

GHSA-55Q8-MFXR-PQ4J

Affected Products

Red Os

Itop

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49145.json · Exploit
• https://github.com/Combodo/iTop/security/advisories/GHSA-55q8-mfxr-pq4j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49145 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49145 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-php-itop-cve-2025-49145-7.3 · Note
• https://twitter.com/CVEnew/status/1987996711017501096 · Twitter Post
• https://twitter.com/CveTodo/status/1988010851714896364 · Twitter Post
• https://twitter.com/CveFindCom/status/1988029261580480947 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-php-itop-cve-2025-49145-8.0 · Note
• https://t.me/cveNotify/143561 · Telegram Post