Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-10722Stored Cross-site Scripting (XSS) in phpipam/phpipam

Low 3.5

In plain English

A low-severity cross-site scripting in phpipam/phpipam from phpipam. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.0)3.5Low

Exploit odds (30 days)0.3%top 71.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability allows attackers to inject malicious scripts into the 'Description' field of custom fields in the 'IP RELATED MANAGEMENT' section. This can lead to data theft, account compromise, distribution of malware, website defacement, content manipulation, and phishing attacks. The issue is fixed in version 1.7.0.

Affected products (as reported)

Vendor	Product	Versions
phpipam	phpipam/phpipam	unspecified – before 1.7.0

Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References