CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2024-10723

A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the destination address field of the NAT tool, which can be executed when a user interacts with the field. The impact of this vulnerability includes the potential theft of user cookies, unauthorized access to user accounts, and redirection to malicious websites. The issue has been fixed in version 1.7.0.

Score
5.4 medium
Published
2025-03-20
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
net-mgmt/phpipamphpipam1.6.0unaddressedjake@xz.cx

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>phpipam</name>
	<range><lt>1.7.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A stored cross-site scripting (XSS) vulnerability was discovered in
	phpipam/phpipam version 1.5.2. This vulnerability allows an attacker
	to inject malicious scripts into the destination address field of the
	NAT tool, which can be executed when a user interacts with the field.
	The impact of this vulnerability includes the potential theft of user
	cookies, unauthorized access to user accounts, and redirection to
	malicious websites. The issue has been fixed in version 1.7.0.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2024-10723</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2024-10723</url>
    </references>
    <dates>
      <discovery>2025-03-20</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>