Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-10720Stored Cross-site Scripting (XSS) in phpipam/phpipam

High 8.2

In plain English

A high-severity cross-site scripting in phpipam/phpipam from phpipam. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.0)8.2High

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability occurs in the 'Device Management' section under 'Administration' where an attacker can inject malicious scripts into the 'Name' and 'Description' fields when adding a new device type. This can lead to data theft, account compromise, distribution of malware, website defacement, and phishing attacks. The issue is fixed in version 1.7.0.

Affected products (as reported)

Vendor	Product	Versions
phpipam	phpipam/phpipam	unspecified – before 1.7.0

Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H

In plain English

Official description

Affected products (as reported)

References