CVE-2019-16692

CVE-2019-16692 CVE-2019-16692phpIPAM 취약점에 대한 익스플로잇 코드...

CVE-2022-23046

CVE-2022-23046 PHPIPAM 1.4.4 - SQLi 인증됨 원본 익스플로잇은 여기에서 찾을 수 있습니다 원본 익스플로잇 작성자: Rodolfo "Inc0gbyt3" Tavares CVE-2022-23046용 Tinker 스크립트 원래 스크립트를 실행하는 데 문제가 있었습니다. 제 사용 사례에 맞게 수정했습니다. THM 룸 Ollie를 완료하는 동안 사용했습니다...

CVE-2022-23046

CVE-2022-23046 PhpIPAM v1.4.4 では、認証された管理者ユーザーが app/admin/routing/edit-bgp-mapping-search.php を介してサブネットを検索する際に、"subnet" パラメータに SQL 文を注入することができます。 インストール 1. ビルド root@kitploit: git clone https://github.com/dnr6419/CVE-2022-23046.git cd CVE-2022-23046 && docker-compose up -d pip3or pip install -r...

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 REST API 認証バイパス phpIPAM REST API における未認証の認証バイパス。オブジェクトキャッシュのキー衝突が原因で、API アプリの appid を解決中にキャッシュされたデータベース行が、提供されたトークンがその行の数値 id と一致する場合に後続の appcode（トークン）チェックを満たしてしまいます。アプリの実際のシークレットは決して比較されません。 CVE : CVE-2026-67602 CVSS 4.0 : 9.3 Critical...

CVE-2022-23046

CVE-2022-23046 원본 발견 및 수동 PoC는 Fluidattacks에서 제공합니다: PhpIPAM v1.4.4는 인증된 관리자 사용자가 app/admin/routing/edit-bgp-mapping-search.php를 통해 서브넷을 검색할 때 "subnet" 매개변수에 SQL 문을 주입할 수 있도록 합니다. 이 PoC는 다음과 같은 정보를 가져오기 위해 간단한 SQLi를 실행합니다: 기본 서버 정보 SMTP 설정 AD/LDAP/Radius와 같은 기타 인증 방법 PHPIpam 사용자 및 해시 MySQL 데이터베이스...

phpIPAM 1.5.1 - Cross-site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. id: CVE-2023-0676 info: name: phpIPAM 1.5.1 - Cross-site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5....

PHPIPAM <v1.5.1 - Missing Authorization

In phpIPAM 1.5.1, an unauthenticated user could download the list of high-usage IP subnets that contains sensitive information such as a subnet description, IP ranges, and usage rates via findfullsubnets.php endpoint. The bug lies in the fact that findfullsubnets.php does not verify if the user i...

phpIPAM - 1.6 - Cross-Site Scripting

phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

phpipam_1.4.4

CVE-2022-23046 phpIPAM 1.4.4 - SQL 인젝션 phpIPAM v1.4.4는 인증된 관리자 사용자가 app/admin/routing/edit-bgp-mapping-search.php를 통해 서브넷을 검색할 때 서브넷 파라미터에 SQL 문을 주입할 수 있도록 허용합니다. 이 프로젝트는 현재 데이터베이스 정보와 호스트 버전 정보를 출력합니다. 또한 서버에서 파일을 읽고 쓰는 것도 시도할 수 있습니다. 시작하기 프로그램 실행 취약한지 확인하려면: root@kitploit: python3 phpipam1.4.4....

CVE-2026-67602

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

CVE-2026-67602

phpIPAM before 1.8.2 contains an authentication bypass in its REST API caused by an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, so an entry written during an app_id lookup can satisfy a subsequent app_code lookup. This al...

EUVD-2026-64889

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

CVE-2026-67602 phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

CVE-2026-67602 phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

CVE-2026-67602 phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

PT-2026-80888

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.2 Description An authentication bypass exists in the REST API due to an insecure object cache keying mechanism. The cache uses only the lookup value as a key and fails to include the searched column. This allows a...

CVE-2026-75105

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...

CVE-2026-75105 phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...

CVE-2026-75105 phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...

EUVD-2026-60385

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...