Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-10719Stored Cross-site Scripting (XSS) in phpipam/phpipam

Low 2.4

In plain English

A low-severity cross-site scripting in phpipam/phpipam from phpipam. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.0)2.4Low

Exploit odds (30 days)0.3%top 71.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality. This vulnerability allows an attacker to inject malicious scripts via the 'option' parameter in the POST request to /phpipam/app/admin/circuits/edit-options-submit.php. The injected script can be executed in the context of the user's browser, leading to potential cookie theft and end-user file disclosure. The issue is fixed in version 1.7.0.

Affected products (as reported)

Vendor	Product	Versions
phpipam	phpipam/phpipam	unspecified – before 1.7.0

Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References