phpipam vulnerabilities and fixes

Recent CVEs affecting phpipam, with upgrade or downgrade steps. 20 tracked.

phpipam has 20 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 12. Most recent: 2025-12-09. Highest priority: CVE-2024-41357 (score 46/100).

• CVE-2025-60912 LOW 3.3 UPGRADE phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality
• CVE-2025-61078 MEDIUM 6.1 DOWNGRADE Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to injec
• CVE-2024-55093 MEDIUM 5.4 UPGRADE phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts.
• CVE-2024-41358 MEDIUM 6.1 DOWNGRADE phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
• CVE-2024-41357 HIGH 7.1 DOWNGRADE phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.
• CVE-2024-41356 MEDIUM 4.7 DOWNGRADE phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php.
• CVE-2024-41355 MEDIUM 6.5 DOWNGRADE phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php.
• CVE-2024-41354 HIGH 7.1 DOWNGRADE phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php
• CVE-2024-41353 HIGH 7.1 DOWNGRADE phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php
• CVE-2024-10727 MEDIUM 6.1 UPGRADE A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0
• CVE-2024-10725 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2
• CVE-2024-10724 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the
• CVE-2024-10723 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2
• CVE-2024-10722 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2
• CVE-2024-10721 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2
• CVE-2024-10720 MEDIUM 6.1 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2
• CVE-2024-10719 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuit
• CVE-2024-10718 HIGH 7.5 UPGRADE In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set
• CVE-2024-0787 MEDIUM 5.9 UPGRADE phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute fo
• CVE-2022-1226 MEDIUM 4.8 UPGRADE A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to exec

FAQ

How do I fix phpipam vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is phpipam being exploited right now?

None of the tracked phpipam CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which phpipam CVE should I patch first?

CVE-2024-41357 currently ranks highest (46/100): phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php..

RSS feed for phpipam · ← Back to latest CVEs