phpIPAM 1.5.1 - Cross-site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. id: CVE-2023-0676 info: name: phpIPAM 1.5.1 - Cross-site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5....

phpIPAM - 1.6 - Cross-Site Scripting

phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

CVE-2022-23046

CVE-2022-23046 PHPIPAM 1.4.4 - SQLi Authenticated Orignal Exploit can be found here Original Exploit Author: Rodolfo "Inc0gbyt3" Tavares Tinker Script for CVE-2022-23046 I was having trouble getting the orginal script to run. Went ahead and tinkered with it for my use case. Used while completeing...

phpipam_1.4.4

CVE-2022-23046 phpIPAM 1.4.4 - SQL Injection phpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the subnet parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. This project currently prints out database information and host version...

CVE-2022-23046

CVE-2022-23046 PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. Installation 1. Build git clone https://github.com/dnr6419/CVE-2022-23046.git cd CVE-2022-23046 &&...

CVE-2019-16692

CVE-2019-16692 Exploit code for CVE-2019-16692, a phpIPAM vulnerability...

CVE-2022-23046

CVE-2022-23046 The original discovery and manual PoC is from Fluidattacks: PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. This PoC executes some easy SQLi to fetch info...

PHPIPAM <v1.5.1 - Missing Authorization

In phpIPAM 1.5.1, an unauthenticated user could download the list of high-usage IP subnets that contains sensitive information such as a subnet description, IP ranges, and usage rates via findfullsubnets.php endpoint. The bug lies in the fact that findfullsubnets.php does not verify if the user i...

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 REST API Authentication Bypass Unauthenticated authentication bypass in the phpIPAM REST API, caused by an object-cache key collision: the database row cached while resolving an API app's appid satisfies the subsequent appcode token check whenever the supplied token...

CVE-2026-115981

A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUESTURI leads to cross site scripting. The attack may be launched remotely. The exploit has been...

CVE-2026-115982

A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function createracklink of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation o...

CVE-2026-115982

A cross-site scripting (XSS) vulnerability exists in phpIPAM versions up to 1.8.3 . The flaw is located in the create_rack_link function within the file app/tools/racks/show-rack-popup.php of the Rack Link Creation component. By manipulating the deviceid argument, an attacker can trigger the XSS....

EUVD-2026-109320

A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function createracklink of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation o...

CVE-2026-115982 phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting

A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function createracklink of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation o...

CVE-2026-115982 phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting

A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function createracklink of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation o...

CVE-2026-115981

The phpIPAM software (up to version 1.8.3 ) is vulnerable to a cross-site scripting (XSS) flaw in the upgrade/index.php file. The root cause is the improper handling of the REQUEST_URI argument, which allows for remote manipulation. This vulnerability has a LOW base severity (CVSS 3.1 score of 2....

EUVD-2026-109318

A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUESTURI leads to cross site scripting. The attack may be launched remotely. The exploit has been...

CVE-2026-115981 phpIPAM index.php cross site scripting

A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUESTURI leads to cross site scripting. The attack may be launched remotely. The exploit has been...

CVE-2026-115981 phpIPAM index.php cross site scripting

A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUESTURI leads to cross site scripting. The attack may be launched remotely. The exploit has been...

phpIPAM cross-site scripting vulnerability

Versions 1.8.3 and earlier of phpIPAM contain a security vulnerability. This vulnerability stems from improper handling of the deviceid parameter in the createracklink function within the file app/tools/racks/show-rack-popup.php in the Rack Link Creation component, potentially leading to cross-si...