Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-97735 | ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email... | < 26.08 | 8.0 | — | 2026-09-25 | |
| CVE-2026-54597 | ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter | * | 8.3 | — | 2026-09-18 | |
| CVE-2026-54596 | ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltrati... | * | 8.1 | — | 2026-09-18 | |
| CVE-2026-47755 | ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal | * | 6.5 | — | 2026-07-24 | |
| CVE-2025-67081 | An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when edi... | * | 4.9 | — | 2026-01-15 | |
| CVE-2024-25344 | Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allo... | * | 6.1 | — | 2024-02-26 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).