Priority LOW 27
Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructions parameter for the /app/admin/instructions/edit-result.php…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00265 · Published 2025-12-09 · No fix listed CWE-79
Priority LOW 15
phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality.
CVSS 3.1LOW 3.3· Network · High privileges · No interaction · EPSS 0.00197 · Published 2025-12-08 · No fix listed CWE-352
Priority LOW 24
phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts.
CVSS 3.1MEDIUM 5.4· Network · No auth · No interaction · EPSS 0.00245 · Published 2025-03-31 · No fix listed CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 60
A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00353 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 60
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00393 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00347 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority HIGH 72
In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00337 · Published 2025-03-20 · Fixed in 1.7.0 CWE-614
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the Subnet NAT translations section when editing the Destination address.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 55
A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00426 · Published 2024-11-15 · Fixed in 1.4.7 CWE-79
Priority HIGH 66
phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0046 · Published 2024-11-15 · Fixed in 1.7.0 CWE-307
Priority LOW 30
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01592 · Published 2024-08-29 · No fix listed CWE-79
Priority MEDIUM 64
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.01119 · Published 2024-07-26 · No fix listed CWE-79
Priority MEDIUM 55
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.0044 · Published 2024-07-26 · No fix listed CWE-79
Priority MEDIUM 62
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · User interaction · EPSS 0.00382 · Published 2024-07-26 · No fix listed CWE-79
Priority MEDIUM 64
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00326 · Published 2024-07-26 · No fix listed CWE-79
Priority MEDIUM 64
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00345 · Published 2024-07-26 · No fix listed CWE-79
Priority HIGH 72
Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00858 · Published 2023-10-02 · No fix listed CWE-74
Priority MEDIUM 55
A vulnerability was found in phpipam 1.5.1.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00649 · Published 2023-09-14 · No fix listed CWE-601
Priority MEDIUM 60
phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.03904 · Published 2023-03-08 · No fix listed CWE-79
Priority MEDIUM 55
Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00473 · Published 2023-03-06 · Fixed in v1.5.2 CWE-79
Priority HIGH 67
SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0305 · Published 2023-03-06 · Fixed in v1.5.2 CWE-89
Load more
THREATIST.IORead the docs