Skip to content
Noroxi

phpipam records

52 published records for vendor phpipam.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
25%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

52 records
  • CVE-2019-16692
    42Plan

    phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    phpipam · phpipamSep 22, 2019

  • CVE-2019-16693
    40Plan

    phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    phpipam · phpipamSep 22, 2019

  • CVE-2019-16695
    40Plan

    phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.

    CriticalCVSS 9.8No exploitEPSS 2%

    phpipam · phpipamSep 22, 2019

  • CVE-2019-16694
    40Plan

    phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used.

    CriticalCVSS 9.8No exploitEPSS 2%

    phpipam · phpipamSep 22, 2019

  • CVE-2019-16696
    40Plan

    phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.

    CriticalCVSS 9.8No exploitEPSS 2%

    phpipam · phpipamSep 22, 2019

  • CVE-2018-1000869
    40Plan

    phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection..

    CriticalCVSS 9.8No exploitEPSS 2%

    phpipam · phpipamDec 20, 2018

  • CVE-2022-41443
    39Monitor

    phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    phpipam · phpipamOct 3, 2022

  • CVE-2022-23046
    36Monitor

    PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/r

    HighCVSS 7.2Proof of conceptEPSS 25%

    phpipam · phpipamJan 19, 2022

  • CVE-2020-7988
    35Monitor

    An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4.

    HighCVSS 8.8No exploitEPSS 1%

    phpipam · phpipamMar 4, 2020

  • CVE-2023-0678
    32Monitor

    Missing Authorization in phpipam/phpipam

    MediumCVSS 5.3Proof of conceptEPSS 37%

    phpipam · phpipamFeb 4, 2023

  • CVE-2023-41580
    30Monitor

    Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php.

    HighCVSS 7.5No exploitEPSS 1%

    phpipam · phpipamOct 2, 2023

  • CVE-2024-10718
    30Monitor

    Cookie without Secure attribute in phpipam/phpipam

    HighCVSS 7.5No exploitEPSS 0%

    phpipam · phpipamMar 20, 2025

  • CVE-2023-1211
    29Monitor

    SQL Injection in phpipam/phpipam

    HighCVSS 7.2Proof of conceptEPSS 3%

    phpipam · phpipamMar 6, 2023

  • CVE-2024-41357
    28Monitor

    phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.

    HighCVSS 7.1Proof of conceptEPSS 1%

    phpipam · phpipamJul 26, 2024

  • CVE-2024-41353
    28Monitor

    phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php

    HighCVSS 7.1No exploitEPSS 0%

    phpipam · phpipamJul 26, 2024

  • CVE-2024-41354
    28Monitor

    phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php

    HighCVSS 7.1No exploitEPSS 0%

    phpipam · phpipamJul 26, 2024

  • CVE-2022-1225
    26Monitor

    Incorrect Privilege Assignment in phpipam/phpipam

    MediumCVSS 6.5No exploitEPSS 1%

    phpipam · phpipamApr 4, 2022

  • CVE-2022-1224
    26Monitor

    Improper Authorization in phpipam/phpipam

    MediumCVSS 6.5No exploitEPSS 1%

    phpipam · phpipamApr 4, 2022

  • CVE-2022-1223
    26Monitor

    Incorrect Authorization in phpipam/phpipam

    MediumCVSS 6.5No exploitEPSS 1%

    phpipam · phpipamApr 4, 2022

  • CVE-2024-41355
    26Monitor

    phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php.

    MediumCVSS 6.5No exploitEPSS 0%

    phpipam · phpipamJul 26, 2024

  • CVE-2023-24657
    25Monitor

    phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/po

    MediumCVSS 6.1Proof of conceptEPSS 4%

    phpipam · phpipamMar 8, 2023

  • CVE-2024-41358
    24Monitor

    phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.

    MediumCVSS 6.1Proof of conceptEPSS 2%

    phpipam · phpipamAug 29, 2024

  • CVE-2023-0676
    24Monitor

    Cross-site Scripting (XSS) - Reflected in phpipam/phpipam

    MediumCVSS 6.1Proof of conceptEPSS 2%

    phpipam · phpipamFeb 4, 2023

  • CVE-2021-35438
    24Monitor

    phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.

    MediumCVSS 6.1No exploitEPSS 1%

    phpipam · phpipamJun 23, 2021

  • CVE-2021-46426
    24Monitor

    phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.

    MediumCVSS 6.1No exploitEPSS 1%

    phpipam · phpipamMar 25, 2022