Priority MEDIUM 57
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_per…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00349 · Published 2026-10-11 · No fix listed CWE-862
Priority MEDIUM 43
phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00317 · Published 2026-09-25 · No fix listed CWE-863
Priority MEDIUM 49
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.0064 · Published 2026-08-24 · Fixed in 1.8.2 CWE-706
Priority MEDIUM 44
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00482 · Published 2026-08-17 · Fixed in 1.8.2 CWE-639
Priority MEDIUM 45
PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00378 · Published 2026-07-04 · No fix listed CWE-98
Priority LOW 27
Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructions parameter for the /app/admin/instructions/edit-result.php…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00265 · Published 2025-12-09 · No fix listed CWE-79
Priority LOW 15
phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality.
CVSS 3.1LOW 3.3· Network · High privileges · No interaction · EPSS 0.00197 · Published 2025-12-08 · No fix listed CWE-352
Priority LOW 24
phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts.
CVSS 3.1MEDIUM 5.4· Network · No auth · No interaction · EPSS 0.00245 · Published 2025-03-31 · No fix listed CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 60
A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00353 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 60
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00393 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00347 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority HIGH 72
In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00337 · Published 2025-03-20 · Fixed in 1.7.0 CWE-614
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the Subnet NAT translations section when editing the Destination address.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2025-03-20 · Fixed in 1.7.0 CWE-79
Priority MEDIUM 55
A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00426 · Published 2024-11-15 · Fixed in 1.4.7 CWE-79
Priority HIGH 66
phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0046 · Published 2024-11-15 · Fixed in 1.7.0 CWE-307
Priority LOW 30
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01592 · Published 2024-08-29 · No fix listed CWE-79
Priority MEDIUM 64
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.01119 · Published 2024-07-26 · No fix listed CWE-79
Priority MEDIUM 55
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.0044 · Published 2024-07-26 · No fix listed CWE-79
Priority MEDIUM 62
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · User interaction · EPSS 0.00382 · Published 2024-07-26 · No fix listed CWE-79
Priority MEDIUM 64
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00326 · Published 2024-07-26 · No fix listed CWE-79
Priority MEDIUM 64
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00345 · Published 2024-07-26 · No fix listed CWE-79
Load more
THREATIST.IORead the docs