已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2026-97735 | ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email... | < 26.08 | 8.0 | — | 2026-09-25 | |
| CVE-2026-54597 | ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter | * | 8.3 | — | 2026-09-18 | |
| CVE-2026-54596 | ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltrati... | * | 8.1 | — | 2026-09-18 | |
| CVE-2026-47755 | ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal | * | 6.5 | — | 2026-07-24 | |
| CVE-2025-67081 | An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when edi... | * | 4.9 | — | 2026-01-15 | |
| CVE-2024-25344 | Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allo... | * | 6.1 | — | 2024-02-26 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。