CVE-2026-12194 | | | 2026-07-04 | PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on t… |
CVE-2025-61078 | Medium | 6.1 | 2025-12-09 | Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructio… |
CVE-2025-60912 | Low | 3.3 | 2025-12-08 | phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the… |
CVE-2024-55093 | Medium | 5.4 | 2025-03-31 | phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts. |
CVE-2024-10727 | Medium | 6.1 | 2025-03-20 | A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0. The vulnerability arises when the application rece… |
CVE-2024-10725 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts in… |
CVE-2024-10724 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the Subnet NAT translations section when editing the… |
CVE-2024-10723 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious sc… |
CVE-2024-10722 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability allows attackers to inject malicious scripts into… |
CVE-2024-10721 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious sc… |
CVE-2024-10720 | Medium | 6.1 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability occurs in the 'Device Management' section under 'A… |
CVE-2024-10719 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality. This vulnerability allow… |
CVE-2024-10718 | High | 7.5 | 2025-03-20 | In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookie… |
CVE-2024-0787 | Medium | 5.9 | 2024-11-15 | phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded… |
CVE-2022-1226 | Medium | 4.8 | 2024-11-15 | A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a… |
CVE-2024-41358 | Medium | 6.1 | 2024-08-29 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php. |
CVE-2024-41354 | High | 7.1 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php |
CVE-2024-41353 | High | 7.1 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php |
CVE-2024-41357 | High | 7.1 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php. |
CVE-2024-41356 | Medium | 4.7 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php. |
CVE-2024-41355 | Medium | 6.5 | 2024-07-26 | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php. |
CVE-2023-41580 | High | 7.5 | 2023-10-02 | Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allow… |
CVE-2023-4965 | Low | 2.7 | 2023-09-14 | A vulnerability was found in phpipam 1.5.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Header Hand… |
CVE-2023-24657 | Medium | 6.1 | 2023-03-08 | phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php. |
CVE-2023-1212 | Medium | 4.8 | 2023-03-07 | Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2. |
CVE-2023-1211 | High | 7.2 | 2023-03-07 | SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2. |
CVE-2023-0678 | Medium | 5.3 | 2023-02-04 | Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1. |
CVE-2023-0677 | Medium | 6.1 | 2023-02-04 | Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1. |
CVE-2023-0676 | Medium | 6.1 | 2023-02-04 | Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. |
CVE-2022-3845 | Low | 2.4 | 2022-11-02 | A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/impor… |
CVE-2022-41443 | Critical | 9.8 | 2022-10-03 | phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php. |
CVE-2022-1225 | Medium | 6.5 | 2022-04-04 | Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6. |
CVE-2022-1224 | Medium | 6.5 | 2022-04-04 | Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6. |
CVE-2022-1223 | Medium | 6.5 | 2022-04-04 | Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6. |
CVE-2021-46426 | Medium | 6.1 | 2022-03-25 | phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality. |
CVE-2022-23046 | High | 7.2 | 2022-01-19 | PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-map… |
CVE-2022-23045 | Medium | 4.8 | 2022-01-19 | PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The… |
CVE-2021-35438 | Medium | 6.1 | 2021-06-23 | phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator. |
CVE-2020-13225 | Medium | 4.8 | 2020-05-20 | phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget. |
CVE-2020-7988 | High | 8.8 | 2020-03-04 | An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and… |
CVE-2019-16696 | Critical | 9.8 | 2019-09-22 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used. |
CVE-2019-16695 | Critical | 9.8 | 2019-09-22 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used. |
CVE-2019-16694 | Critical | 9.8 | 2019-09-22 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used. |
CVE-2019-16693 | Critical | 9.8 | 2019-09-22 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used. |
CVE-2019-16692 | Critical | 9.8 | 2019-09-22 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used. |
CVE-2019-1000010 | Medium | 6.1 | 2019-02-04 | phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims br… |
CVE-2018-1000870 | Medium | 5.4 | 2018-12-20 | PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. Th… |
CVE-2018-1000869 | Critical | 9.8 | 2018-12-20 | phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploit… |
CVE-2018-1000860 | Medium | 4.7 | 2018-12-20 | phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on… |
CVE-2018-10329 | Medium | 6.1 | 2018-04-24 | app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter. |
CVE-2017-15640 | Medium | 5.4 | 2018-04-21 | app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter. |
CVE-2017-6481 | Medium | 6.1 | 2017-03-05 | Multiple Cross-Site Scripting (XSS) issues were discovered in phpipam 1.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passe… |
CVE-2015-6529 | | | 2015-08-20 | Multiple cross-site scripting (XSS) vulnerabilities in phpipam 1.1.010 allow remote attackers to inject arbitrary web script or HTML via the (1) section parame… |