Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
60 results · page 1 of 2
Oct 24, 2026A vulnerability was detected in phpIPAM up to 1.8.3.CVE-2026-115982 · Other software · reported by VulDBLow 2.1
A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 24, 2026A security vulnerability has been detected in phpIPAM up to 1.8.3.CVE-2026-115981 · Other software · reported by VulDBLow 1.9
A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 11, 2026phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses becaCVE-2026-108720 · Websites & servers · phpipam · reported by VulnCheckMedium 5.3
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access.
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.CVE-2026-97818 · Websites & servers · phpipam · reported by MITREHigh 8.6
phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.
- Product
- phpIPAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploitingCVE-2026-67602 · Websites & servers · phpipam · reported by VulnCheckCritical 9.3
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for.CVE-2026-75105 · Websites & servers · phpipam · reported by VulnCheckHigh 8.7
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2026PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on thCVE-2026-12194 · Websites & servers · phpipam · reported by ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4aLow 2.3
PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations.
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectblack.io
Mar 16, 2026A weakness has been identified in phpipam up to 1.7.4.CVE-2026-4189 · Other software · reported by VulDBLow 2
A weakness has been identified in phpipam up to 1.7.4. The impacted element is an unknown function of the file app/admin/sections/edit-result.php of the component Section Handler. Executing a manipulation of the argument subnetOrdering can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Dec 9, 2025Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructionCVE-2025-61078 · Websites & servers · Phpipam · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructions parameter for the /app/admin/instructions/edit-result.php endpoint.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality.CVE-2025-60912 · Websites & servers · Phpipam · reported by MITRELow 3.3
phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an administrator has an active session.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 31, 2025phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts.CVE-2024-55093 · Websites & servers · phpIPAM · reported by MITREMedium 5.4
phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts.
- Product
- phpIPAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0.CVE-2024-10727 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.1
A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0. The vulnerability arises when the application receives data in an HTTP request and includes that data within the immediate response in an unsafe manner. This allows an attacker to execute arbitrary JavaScript in the context of the user's browser, potentially leading to full compromise of the user.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2.CVE-2024-10725 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which are then executed in the context of other users who view the affected pages. The issue occurs when editing the NAT destination address, where user input is not properly sanitized. This can lead to data theft, account compromise, and other malicious activities. The vulnerability is fixed in version 1.7.0.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the Subnet NAT translations section when editing the CVE-2024-10724 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the Subnet NAT translations section when editing the Destination address. This vulnerability allows an attacker to execute malicious code. The issue is fixed in version 1.7.0.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2.CVE-2024-10723 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.4
A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the destination address field of the NAT tool, which can be executed when a user interacts with the field. The impact of this vulnerability includes the potential theft of user cookies, unauthorized access to user accounts, and redirection to malicious websites. The issue has been fixed in version 1.7.0.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2.CVE-2024-10722 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability allows attackers to inject malicious scripts into the 'Description' field of custom fields in the 'IP RELATED MANAGEMENT' section. This can lead to data theft, account compromise, distribution of malware, website defacement, content manipulation, and phishing attacks. The issue is fixed in version 1.7.0.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2.CVE-2024-10721 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.4
A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which can be executed in the context of other users who view the affected page. The issue occurs in the circuits options page (https://demo.phpipam.net/tools/circuits/options/). An attacker can exploit this vulnerability to steal cookies, gain unauthorized access to user accounts, or redirect users to malicious websites. The vulnerability has been fixed in version 1.7.0.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2.CVE-2024-10720 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.1
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability occurs in the 'Device Management' section under 'Administration' where an attacker can inject malicious scripts into the 'Name' and 'Description' fields when adding a new device type. This can lead to data theft, account compromise, distribution of malware, website defacement, and phishing attacks. The issue is fixed in version 1.7.0.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality.CVE-2024-10719 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality. This vulnerability allows an attacker to inject malicious scripts via the 'option' parameter in the POST request to /phpipam/app/admin/circuits/edit-options-submit.php. The injected script can be executed in the context of the user's browser, leading to potential cookie theft and end-user file disclosure. The issue is fixed in version 1.7.0.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set.CVE-2024-10718 · Websites & servers · phpipam · reported by security@huntr.devHigh 7.5
In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed in version 1.7.0.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-CVE-2024-0787 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.9
phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'get_user_ip()' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the 'X-Forwarded-For' header is checked and used instead of 'REMOTE_ADDR'. This vulnerability allows attackers to perform brute force attacks on user accounts, including the admin account. The issue is fixed in version 1.7.0.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a CVE-2022-1226 · Websites & servers · phpipam · reported by security@huntr.devMedium 4.8
A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include import-vlan-preview.php, import-subnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-preview.php, and import-l2dom-preview.php. The vulnerability can be exploited by uploading a specially crafted spreadsheet file containing malicious JavaScript payloads, which are then executed in the context of the victim's browser. This can lead to defacement of websites, execution of malicious JavaScript code, stealing of user cookies, and unauthorized access to user accounts.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.CVE-2024-41358 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.phpCVE-2024-41354 · Websites & servers · phpipam · reported by MITREHigh 7.1
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.phpCVE-2024-41353 · Websites & servers · phpipam · reported by MITREHigh 7.1
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.CVE-2024-41357 · Websites & servers · phpipam · reported by MITREHigh 7.1
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php.CVE-2024-41356 · Websites & servers · phpipam · reported by MITREMedium 4.7
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php.
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php.CVE-2024-41355 · Websites & servers · phpipam · reported by MITREMedium 6.5
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php.
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php.CVE-2023-41580 · Websites & servers · Phpipam · reported by MITREHigh 7.5
Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A vulnerability was found in phpipam 1.5.1.CVE-2023-4965 · Websites & servers · Phpipam · reported by VulDBLow 2.7
A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239732.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.CVE-2023-24657 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.CVE-2023-1212 · Websites & servers · phpipam · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.CVE-2023-1211 · Websites & servers · phpipam · reported by security@huntr.devHigh 7.2
SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.CVE-2023-0678 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.3
Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.CVE-2023-0677 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.CVE-2023-0676 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022A vulnerability has been found in phpipam and classified as problematic.CVE-2022-3845 · Other software · unspecified · reported by VulDBLow 2.4
A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 22c797c3583001211fe7d31bccd3f1d4aeeb3bbc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-212863.
- Product
- phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2022phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.CVE-2022-41443 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 4, 2022Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6.CVE-2022-1225 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.5
Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.CVE-2022-1224 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.5
Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.CVE-2022-1223 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.5
Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.CVE-2021-46426 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 19, 2022PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mappCVE-2022-23046 · Websites & servers · Phpipam · reported by help@fluidattacks.comHigh 7.2
PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfluidattacks.com
Jan 19, 2022PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings.CVE-2022-23045 · Websites & servers · Phpipam · reported by help@fluidattacks.comMedium 4.8
PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The "Site title" setting is injected in several locations which triggers the XSS.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jun 23, 2021phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.CVE-2021-35438 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2020phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget.CVE-2020-13225 · Websites & servers · Phpipam · reported by MITREMedium 4.8
phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2020An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4.CVE-2020-7988 · Websites & servers · Phpipam · reported by MITREHigh 8.8
An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lack of security tokens.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.comphpipam.net
Sep 22, 2019phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.CVE-2019-16696 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2019phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.CVE-2019-16695 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2019phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used.CVE-2019-16694 · Websites & servers · Phpipam · reported by MITRECritical 9.8
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.