Phpipam

phpipam

52 CVEs • 1 product

Products (1)

Click to collapse

Toggle

Phpipam

phpipam

52 CVEs

CVEs (52)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-41580 1Phpipam 1Phpipam Jun 17, 2026 Oct 2, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server...Show more Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.Show less
CVE-2023-4965 1Phpipam 1Phpipam Jun 17, 2026 Sep 14, 2023 N/A· v4 4.8 MEDIUM· v3 3.3 LOW· v2 A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads...Show more A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Handler. The manipulation of the argument X-Forwarded-Host leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239732.Show less
CVE-2023-24657 1Phpipam 1Phpipam Jun 17, 2026 Mar 8, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.
CVE-2023-1212 1Phpipam 1Phpipam Jun 17, 2026 Mar 7, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.
CVE-2023-1211 1Phpipam 1Phpipam Jun 17, 2026 Mar 7, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
CVE-2023-0678 1Phpipam 1Phpipam Jun 17, 2026 Feb 4, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.
CVE-2023-0677 1Phpipam 1Phpipam Jun 17, 2026 Feb 4, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.
CVE-2023-0676 1Phpipam 1Phpipam Jun 17, 2026 Feb 4, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
CVE-2022-3845 1Phpipam 1Phpipam Jun 17, 2026 Nov 2, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview...Show more A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 22c797c3583001211fe7d31bccd3f1d4aeeb3bbc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-212863.Show less
CVE-2022-41443 1Phpipam 1Phpipam Jun 17, 2026 Oct 3, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.
CVE-2022-1225 1Phpipam 1Phpipam Jun 17, 2026 Apr 4, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6.
CVE-2022-1224 1Phpipam 1Phpipam Jun 17, 2026 Apr 4, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
CVE-2022-1223 1Phpipam 1Phpipam Jun 17, 2026 Apr 4, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
CVE-2021-46426 1Phpipam 1Phpipam Jun 17, 2026 Mar 25, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.
CVE-2022-23046 1Phpipam 1Phpipam Jun 17, 2026 Jan 19, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php
CVE-2022-23045 1Phpipam 1Phpipam Jun 17, 2026 Jan 19, 2022 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The "Site title" setting is injected in several locations which t...Show more PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The "Site title" setting is injected in several locations which triggers the XSS.Show less
CVE-2021-35438 1Phpipam 1Phpipam Jun 17, 2026 Jun 23, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.
CVE-2020-13225 1Phpipam 1Phpipam Jun 17, 2026 May 20, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget.
CVE-2020-7988 1Phpipam 1Phpipam Jun 17, 2026 Mar 4, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exi...Show more An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lack of security tokens.Show less
CVE-2019-16696 1Phpipam 1Phpipam Jun 17, 2026 Sep 22, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.

Previous 123 Next