CVE-2019-16692

CVE-2019-16692 Эксплойт для CVE-2019-16692, уязвимости phpIPAM...

PHPIPAM <v1.5.1 - Missing Authorization

In phpIPAM 1.5.1, an unauthenticated user could download the list of high-usage IP subnets that contains sensitive information such as a subnet description, IP ranges, and usage rates via findfullsubnets.php endpoint. The bug lies in the fact that findfullsubnets.php does not verify if the user i...

phpIPAM 1.5.1 - Cross-site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. id: CVE-2023-0676 info: name: phpIPAM 1.5.1 - Cross-site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5....

phpIPAM - 1.6 - Cross-Site Scripting

phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

CVE-2022-23046

CVE-2022-23046 PhpIPAM v1.4.4 позволяет аутентифицированному администратору внедрять SQL-запросы в параметр "subnet" при поиске подсети через app/admin/routing/edit-bgp-mapping-search.php. Установка 1. Сборка git clone https://github.com/dnr6419/CVE-2022-23046.git cd CVE-2022-23046 &&...

CVE-2022-23046

CVE-2022-23046 Оригинальное обнаружение и ручной PoC от Fluidattacks: PhpIPAM v1.4.4 позволяет аутентифицированному администратору внедрять SQL-выражения в параметр "subnet" при поиске подсети через app/admin/routing/edit-bgp-mapping-search.php. Этот PoC выполняет простые SQL-инъекции для получен...

CVE-2022-23046

CVE-2022-23046 PHPIPAM 1.4.4 - SQLi Authenticated Оригинальный эксплойт можно найти здесь Автор оригинального эксплойта: Rodolfo "Inc0gbyt3" Tavares Скрипт-доработка для CVE-2022-23046 У меня возникли проблемы с запуском оригинального скрипта. Я решил его доработать под свои нужды. Использовался...

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602 — phpIPAM 1.8.2 Обход аутентификации REST API Неаутентифицированный обход аутентификации в REST API phpIPAM, вызванный коллизией ключей объектного кэша: строка базы данных, кэшируемая при разрешении appid приложения API, удовлетворяет последующей проверке appcode токена всякий раз,...

phpipam_1.4.4

CVE-2022-23046 phpIPAM 1.4.4 - SQL-инъекция phpIPAM v1.4.4 позволяет аутентифицированному пользователю с правами администратора внедрять SQL-выражения в параметр subnet при поиске подсети через app/admin/routing/edit-bgp-mapping-search.php. Данный проект выводит информацию о базе данных и версии...

CVE-2026-97818

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php...

CVE-2026-97818

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php...

CVE-2026-97818

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php...

CVE-2026-97818

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php...

CVE-2026-97818

The phpIPAM software, through version 1.8.3 , is vulnerable to an incorrect authorization flaw located in api/controllers/User.php. The issue specifically involves incorrect handling for `id==

EUVD-2026-86523

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php...

PT-2026-98354

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.4 Description Incorrect authorization exists in the api/controllers/User.php file when the id variable is set to "admins" or "all". Recommendations Update to version 1.8.4 or later...

CVE-2026-97818: Incorrect Authorization

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php...

Exploit for CVE-2026-67602

CVE-2026-67602 — phpIPAM row id=2, appsecurity=sslcode 2...

CVE-2026-67602

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

CVE-2026-67602

phpIPAM before 1.8.2 contains an authentication bypass in its REST API caused by an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, so an entry written during an app_id lookup can satisfy a subsequent app_code lookup. This al...