既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-97735 | ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email... | < 26.08 | 8.0 | — | 2026-09-25 | |
| CVE-2026-54597 | ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter | * | 8.3 | — | 2026-09-18 | |
| CVE-2026-54596 | ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltrati... | * | 8.1 | — | 2026-09-18 | |
| CVE-2026-47755 | ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal | * | 6.5 | — | 2026-07-24 | |
| CVE-2025-67081 | An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when edi... | * | 4.9 | — | 2026-01-15 | |
| CVE-2024-25344 | Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allo... | * | 6.1 | — | 2024-02-26 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。