$ cve CVE-2011-4275 JSON

CVE-2011-4275 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 1.5% (pctl 73)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in iTop (aka IT Operations Portal) 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted company name, (2) a crafted database server name, (3) a crafted CSV file, (4) a crafted copy-and-paste action, (5) the auth_user parameter in a suggest_pwd action to UI.php, (6) the c[menu] parameter to UniversalSearch.php, (7) the description parameter in a SearchFormToAdd_document_list action to UI.php, (8) the category parameter in an errors action to audit.php, or (9) the suggest_pwd parameter to UI.php.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	1.49% — more likely to be exploited than 73% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2011-11-26
Last modified	2026-06-16

Affected (1)

Vendor	Product
combodo	itop

Public exploits

Source	Title	Date
exploit-db	Open Flash Chart 2 - Arbitrary File Upload (Metasploit)	2013-10-26
exploit-db	ZonPHP 2.25 - Remote Code Execution	2013-10-20
exploit-db	Joomla! Component com_civicrm 4.2.2 - Remote Code Injection	2013-04-22
exploit-db	OpenEMR - Arbitrary '.PHP' File Upload (Metasploit)	2013-02-20
exploit-db	OpenEMR 4.1.1 - 'ofc_upload_image.php' Arbitrary File Upload	2013-02-13
exploit-db	Piwik Open Flash Chart - Remote Code Execution	2009-12-17

References

→ the Explorer · watch your stack · NVD