689 matches found
CVE-2026-115982 phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting
A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function createracklink of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation o...
CVE-2026-115982
A cross-site scripting (XSS) vulnerability exists in phpIPAM versions up to 1.8.3 . The flaw is located in the create_rack_link function within the file app/tools/racks/show-rack-popup.php of the Rack Link Creation component. By manipulating the deviceid argument, an attacker can trigger the XSS....
CVE-2026-115981
The phpIPAM software (up to version 1.8.3 ) is vulnerable to a cross-site scripting (XSS) flaw in the upgrade/index.php file. The root cause is the improper handling of the REQUEST_URI argument, which allows for remote manipulation. This vulnerability has a LOW base severity (CVSS 3.1 score of 2....
CVE-2022-23046
CVE-2022-23046 PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. Installation 1. Build git clone https://github.com/dnr6419/CVE-2022-23046.git cd CVE-2022-23046 &&...
CVE-2022-23046
CVE-2022-23046 PHPIPAM 1.4.4 - SQLi Authenticated Orignal Exploit can be found here Original Exploit Author: Rodolfo "Inc0gbyt3" Tavares Tinker Script for CVE-2022-23046 I was having trouble getting the orginal script to run. Went ahead and tinkered with it for my use case. Used while completeing...
CVE-2019-16692
CVE-2019-16692 Exploit code for CVE-2019-16692, a phpIPAM vulnerability...
phpIPAM 1.5.1 - Cross-site Scripting
Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. id: CVE-2023-0676 info: name: phpIPAM 1.5.1 - Cross-site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5....
phpIPAM - 1.6 - Cross-Site Scripting
phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...
PHPIPAM <v1.5.1 - Missing Authorization
In phpIPAM 1.5.1, an unauthenticated user could download the list of high-usage IP subnets that contains sensitive information such as a subnet description, IP ranges, and usage rates via findfullsubnets.php endpoint. The bug lies in the fact that findfullsubnets.php does not verify if the user i...
CVE-2022-23046
CVE-2022-23046 The original discovery and manual PoC is from Fluidattacks: PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. This PoC executes some easy SQLi to fetch info...
the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass
CVE-2026-67602 — phpIPAM 1.8.2 REST API Authentication Bypass Unauthenticated authentication bypass in the phpIPAM REST API, caused by an object-cache key collision: the database row cached while resolving an API app's appid satisfies the subsequent appcode token check whenever the supplied token...
phpipam_1.4.4
CVE-2022-23046 phpIPAM 1.4.4 - SQL Injection phpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the subnet parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. This project currently prints out database information and host version...
CVE-2026-108720
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...
EUVD-2026-96994
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...
CVE-2026-108720 phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...
CVE-2026-108720
Versions of phpIPAM through 1.8.3 are vulnerable to a missing authorization flaw (CWE-862). The issue occurs because the customer, location, and NAT pages fail to execute the Subnets::check_permission function. This allows authenticated low-privilege users to access restricted sections by opening...
CVE-2026-108720 phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...
CVE-2026-108720: Missing Authorization
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...
