CVE-2024-10721CWE-79

Store XSS in phpipam/phpipam

Low · published March 20, 2025

CVSS v3.0
3.5
EPSS
0%
Percentile
27.3
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which can be executed in the context of other users who view the affected page. The issue occurs in the circuits options page (https://demo.phpipam.net/tools/circuits/options/). An attacker can exploit this vulnerability to steal cookies, gain unauthorized access to user accounts, or redirect users to malicious websites. The vulnerability has been fixed in version 1.7.0.

The record
Technical detail
CVSS v3.0
3.5 · LOW
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00349 · 27.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-03-20T10:11Z
EPSS history
Timeline
  • 20 MAR 10:11Z
    Store XSS in phpipam/phpipam
    cvelistv5