CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2024-10720

A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability occurs in the 'Device Management' section under 'Administration' where an attacker can inject malicious scripts into the 'Name' and 'Description' fields when adding a new device type. This can lead to data theft, account compromise, distribution of malware, website defacement, and phishing attacks. The issue is fixed in version 1.7.0.

Score
6.1 medium
Published
2025-03-20
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
net-mgmt/phpipamphpipam1.6.0unaddressedjake@xz.cx

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>phpipam</name>
	<range><lt>1.7.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A stored cross-site scripting (XSS) vulnerability exists in
	phpipam/phpipam version 1.5.2. The vulnerability occurs in the 'Device
	Management' section under 'Administration' where an attacker can
	inject malicious scripts into the 'Name' and 'Description' fields when
	adding a new device type. This can lead to data theft, account
	compromise, distribution of malware, website defacement, and phishing
	attacks. The issue is fixed in version 1.7.0.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2024-10720</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2024-10720</url>
    </references>
    <dates>
      <discovery>2025-03-20</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>