Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Low | 2.1 | CVE-2026-115982 |
A vulnerability was detected in phpIPAM up to 1.8.3
phpipamphpipam
|
NVD | |||
|
CVE-2026-115982A vulnerability was detected in phpIPAM up to 1.8.3
Executive summaryA reflected cross-site scripting flaw affects phpIPAM versions up to and including 1.8.3. An attacker can craft a link that runs malicious scripts in the browser of a logged-in user who opens it, which could lead to session hijacking or unauthorized actions. The advisory states the maintainer confirmed a fix will be included in the next release, and no fixed version is stated. Technical summaryThe flaw is reflected cross-site scripting in app/tools/racks/show-rack-popup.php, where the deviceid parameter is passed to create_rack_link() and placed unescaped into an img src attribute. strip_tags() removes HTML tags but leaves double quotes and event handlers, so a crafted link can break out of the attribute and run JavaScript when a victim visits it. The advisory says an admin login is needed to reach the Racks feature by default, and the CVSS 3.1 base score of 4.2 (Medium) is given with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. The suggested mitigation is validating deviceid with is_numeric() and escaping the output with escape_input(). A fixed version number is not stated, and no workaround or detection guidance beyond the proof of concept is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/KHr00t/a7f3b2eea71d30ad7ccf65e1d47e502f Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 1.9 | CVE-2026-115981 |
A security vulnerability has been detected in phpIPAM up to 1.8.3
phpipamphpipam
|
NVD | |||
|
CVE-2026-115981A security vulnerability has been detected in phpIPAM up to 1.8.3
Executive summaryA reflected cross-site scripting flaw affects phpIPAM versions 1.7.4 through 1.8.3 when run on PHP 7.x. An attacker who tricks a user into opening a crafted link could run scripts in that user's browser session, which could lead to session hijacking or unauthorized actions. The advisory gives the CVSS base score as 4.2 (Medium), and it does not state a vendor fix or workaround. Technical summaryThe flaw is reflected cross-site scripting in upgrade/index.php, where REQUEST_URI is printed into the HTML response without proper output encoding. The bug comes from a misplaced print inside the escape_input call, so the unescaped string is output before escaping runs, and the file also lacks the functions/functions.php include. The attack requires a victim to visit a crafted link, and the advisory states the CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. The advisory says the issue affects phpIPAM 1.7.4 to 1.8.3 on PHP 7.x, and it says install/index.php was fixed in 1.7.4 (commit 181a12e), but it does not state a fixed version for upgrade/index.php. Workarounds and detection guidance are not stated, though the reporter suggests inverting the function nesting so escape_input() runs before print. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/KHr00t/f9351510717a5dac4797920fe532fe1e Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-108720 |
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer,...
phpipamphpipam
|
NVD | |||
|
CVE-2026-108720phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer,...
From the advisoryphpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access. Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||