Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
86 results · page 2 of 2
Sep 14, 2023A vulnerability was found in phpipam 1.5.1.CVE-2023-4965 · Websites & servers · Phpipam · reported by VulDBLow 2.7
A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239732.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.CVE-2023-24657 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.CVE-2023-1212 · Websites & servers · phpipam · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.CVE-2023-1211 · Websites & servers · phpipam · reported by security@huntr.devHigh 7.2
SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.CVE-2023-0678 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.3
Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.CVE-2023-0677 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.CVE-2023-0676 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022A vulnerability classified as problematic has been found in django-openipam.CVE-2022-4595 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in django-openipam. This affects an unknown part of the file openipam/report/templates/report/exposed_hosts.html. The manipulation of the argument description leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is a6223a1150d60cd036106ba6a8e676c1bfc3cc85. It is recommended to apply a patch to fix this issue. The identifier VDB-216189 was assigned to this vulnerability.
- Product
- django-openipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022A vulnerability has been found in phpipam and classified as problematic.CVE-2022-3845 · Other software · unspecified · reported by VulDBLow 2.4
A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 22c797c3583001211fe7d31bccd3f1d4aeeb3bbc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-212863.
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.CVE-2022-41443 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 4, 2022Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6.CVE-2022-1225 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.5
Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.CVE-2022-1224 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.5
Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.CVE-2022-1223 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.5
Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.CVE-2021-46426 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 19, 2022PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mappCVE-2022-23046 · Websites & servers · Phpipam · reported by help@fluidattacks.comHigh 7.2
PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfluidattacks.com
Jan 19, 2022PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings.CVE-2022-23045 · Websites & servers · Phpipam · reported by help@fluidattacks.comMedium 4.8
PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The "Site title" setting is injected in several locations which triggers the XSS.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jun 23, 2021phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.CVE-2021-35438 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2020phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget.CVE-2020-13225 · Websites & servers · Phpipam · reported by MITREMedium 4.8
phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2020An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4.CVE-2020-7988 · Websites & servers · Phpipam · reported by MITREHigh 8.8
An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lack of security tokens.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.comphpipam.net
Sep 22, 2019phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.CVE-2019-16696 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2019phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.CVE-2019-16695 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2019phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used.CVE-2019-16694 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2019phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.CVE-2019-16693 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2019phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.CVE-2019-16692 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 4, 2019phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims broCVE-2019-1000010 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims browser. This attack appears to be exploitable via victim visits link crafted by an attacker. This vulnerability appears to have been fixed in 1.4.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2018PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser.CVE-2018-1000870 · Websites & servers · Phpipam · reported by MITREMedium 5.4
PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. Admin(Victim) views user in admin-panel and gets exploited.. This vulnerability appears to have been fixed in 1.4.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2018phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection..CVE-2018-1000869 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploitable via Rough user, exploiting the vulnerability to access information he/she does not have access to.. This vulnerability appears to have been fixed in 1.4.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2018phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on tCVE-2018-1000860 · Websites & servers · Phpipam · reported by MITREMedium 4.7
phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on the login page encapsulated in single quotes. Editing the value of the cookie to r5zkh'><script>alert(1)</script>quqtl exploits an XSS vulnerability. that can result in Arbitrary code executes in victims browser.. This attack appear to be exploitable via Needs to be chained with another exploit that allows an attacker to set or modify a cookie for the phpIPAM instance's domain..
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2018app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter.CVE-2018-10329 · Websites & servers · Phpipam · reported by MITREMedium 6.1
app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2018app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter.CVE-2017-15640 · Websites & servers · Phpipam · reported by MITREMedium 5.4
app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2017A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variaCVE-2017-9649 · Other software · Mirion Technologies · reported by ics-cert@hq.dhs.govMedium 5
A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants (including RSD31-AM Package), DRM-1/2 and variants (including Solar PWR Package), DRM and RDS Based Boundary Monitors, External Transmitters, Telepole II, and MESH Repeater (Telemetry Enabled Devices). An unchangeable, factory-set key is included in the 900 MHz transmitter firmware.
- Product
- DMC 3000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Sep 20, 2017An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants CVE-2017-9645 · Other software · Mirion · reported by ics-cert@hq.dhs.govMedium 6.5
An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants (including RSD31-AM Package), DRM-1/2 and variants (including Solar PWR Package), DRM and RDS Based Boundary Monitors, External Transmitters, Telepole II, and MESH Repeater (Telemetry Enabled Devices). Decryption of data is possible at the hardware level.
- Product
- DMC 3000 Transmitter Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Mar 5, 2017Multiple Cross-Site Scripting (XSS) issues were discovered in phpipam 1.2.CVE-2017-6481 · Websites & servers · Phpipam · reported by MITREMedium 6.1
Multiple Cross-Site Scripting (XSS) issues were discovered in phpipam 1.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages (instructions in app/admin/instructions/preview.php; subnetId in app/admin/powerDNS/refresh-ptr-records.php). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Aug 20, 2015Multiple cross-site scripting (XSS) vulnerabilities in phpipam 1.1.010 allow remote attackers to inject arbitrary web script or HTML via the (1) section parametCVE-2015-6529 · Websites & servers · Phpipam · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in phpipam 1.1.010 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter to site/error.php or (2) ip parameter to site/tools/searchResults.php.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhyp3rlinx.altervista.orgpacketstormsecurity.com
Oct 31, 2012Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor miCVE-2012-4939 · Other software · Solarwinds · reported by cret@cert.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field.
- Product
- IP Address Manager Web Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Aug 8, 2007Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 (Adonis DNS/DHCP appliance 5.0.2.8) allows remote authenticated adminisCVE-2007-4226 · Other software · Bluecat Networks · reported by MITREHigh 7.1
Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 (Adonis DNS/DHCP appliance 5.0.2.8) allows remote authenticated administrators, with certain TFTP privileges, to create and overwrite arbitrary files via a .. (dot dot) in a pathname. NOTE: this can be leveraged for administrative access by overwriting /etc/shadow.
- Product
- Adonis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.