CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2024-10722

A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability allows attackers to inject malicious scripts into the 'Description' field of custom fields in the 'IP RELATED MANAGEMENT' section. This can lead to data theft, account compromise, distribution of malware, website defacement, content manipulation, and phishing attacks. The issue is fixed in version 1.7.0.

Score
5.4 medium
Published
2025-03-20
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
net-mgmt/phpipamphpipam1.6.0unaddressedjake@xz.cx

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>phpipam</name>
	<range><lt>1.7.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A stored cross-site scripting (XSS) vulnerability exists in
	phpipam/phpipam version 1.5.2. The vulnerability allows attackers to
	inject malicious scripts into the 'Description' field of custom fields
	in the 'IP RELATED MANAGEMENT' section. This can lead to data theft,
	account compromise, distribution of malware, website defacement,
	content manipulation, and phishing attacks. The issue is fixed in
	version 1.7.0.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2024-10722</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2024-10722</url>
    </references>
    <dates>
      <discovery>2025-03-20</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>