Aggregates CVE and security vulnerability intelligence across all phpipam-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk sql injection and vendor risk csrf and related problems; some flaws may lead to vendor impact session compromise, affecting vendor surface software deployment scenarios.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2019-16695 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used. | [email protected] | 9.8 | 1.88% | 2019-09-22 | 2026-06-16 |
| CVE-2019-16694 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used. | [email protected] | 9.8 | 1.88% | 2019-09-22 | 2026-06-16 |
| CVE-2019-16693 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used. | [email protected] | 9.8 | 4.34% | 2019-09-22 | 2026-06-16 |
| CVE-2019-16692 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used. | [email protected] | 9.8 | 10.32% | 2019-09-22 | 2026-06-16 |
| CVE-2019-1000010 | phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims browser. This attack appears to be exploitable via victim visits link crafted by an attacker. This vulnerability appears to have been fixed in 1.4. | [email protected] | 6.1 | 0.86% | 2019-02-04 | 2026-06-16 |
| CVE-2018-1000870 | PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. Admin(Victim) views user in admin-panel and gets exploited.. This vulnerability appears to have been fixed in 1.4. | [email protected] | 5.4 | 0.95% | 2018-12-20 | 2026-06-16 |
| CVE-2018-1000869 | phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploitable via Rough user, exploiting the vulnerability to access information he/she does not have access to.. This vulnerability appears to have been fixed in 1.4. | [email protected] | 9.8 | 1.79% | 2018-12-20 | 2026-06-16 |
| CVE-2018-1000860 | phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on the login page encapsulated in single quotes. Editing the value of the cookie to r5zkh'><script>alert(1)</script>quqtl exploits an XSS vulnerability. that can result in Arbitrary code executes in victims browser.. This attack appear to be exploitable via Needs to be chained with another exploit that allows an attacker to set or modify a co | [email protected] | 4.7 | 0.80% | 2018-12-20 | 2026-06-16 |
| CVE-2018-10329 | app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter. | [email protected] | 6.1 | 0.84% | 2018-04-24 | 2026-06-16 |
| CVE-2017-15640 | app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter. | [email protected] | 5.4 | 0.70% | 2018-04-21 | 2026-06-16 |
| CVE-2017-6481 | Multiple Cross-Site Scripting (XSS) issues were discovered in phpipam 1.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages (instructions in app/admin/instructions/preview.php; subnetId in app/admin/powerDNS/refresh-ptr-records.php). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. | [email protected] | 6.1 | 0.71% | 2017-03-05 | 2026-06-16 |
| CVE-2015-6529 | Multiple cross-site scripting (XSS) vulnerabilities in phpipam 1.1.010 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter to site/error.php or (2) ip parameter to site/tools/searchResults.php. | [email protected] | 4.3 | 2.43% | 2015-08-20 | 2026-06-16 |