CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2024-10719

A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality. This vulnerability allows an attacker to inject malicious scripts via the 'option' parameter in the POST request to /phpipam/app/admin/circuits/edit-options-submit.php. The injected script can be executed in the context of the user's browser, leading to potential cookie theft and end-user file disclosure. The issue is fixed in version 1.7.0.

Score
5.4 medium
Published
2025-03-20
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
net-mgmt/phpipamphpipam1.6.0unaddressedjake@xz.cx

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>phpipam</name>
	<range><lt>1.7.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A stored cross-site scripting (XSS) vulnerability exists in phpipam
	version 1.5.2, specifically in the circuits options functionality.
	This vulnerability allows an attacker to inject malicious scripts via
	the 'option' parameter in the POST request to
	/phpipam/app/admin/circuits/edit-options-submit.php. The injected
	script can be executed in the context of the user's browser, leading
	to potential cookie theft and end-user file disclosure. The issue is
	fixed in version 1.7.0.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2024-10719</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2024-10719</url>
    </references>
    <dates>
      <discovery>2025-03-20</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>