CVE-2024-10722

Description

A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability allows attackers to inject malicious scripts into the 'Description' field of custom fields in the 'IP RELATED MANAGEMENT' section. This can lead to data theft, account compromise, distribution of malware, website defacement, content manipulation, and phishing attacks. The issue is fixed in version 1.7.0.

Reserved 2024-11-01 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Any version before 1.7.0
affected

References

huntr.com/bounties/f0bc97b2-33a9-4b15-aa05-ff7c57624847

github.com/...ommit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731

cve.org (CVE-2024-10722)

nvd.nist.gov (CVE-2024-10722)

Download JSON