CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2024-10725

A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which are then executed in the context of other users who view the affected pages. The issue occurs when editing the NAT destination address, where user input is not properly sanitized. This can lead to data theft, account compromise, and other malicious activities. The vulnerability is fixed in version 1.7.0.

Score
5.4 medium
Published
2025-03-20
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
net-mgmt/phpipamphpipam1.6.0unaddressedjake@xz.cx

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>phpipam</name>
	<range><lt>1.7.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A stored cross-site scripting (XSS) vulnerability exists in
	phpipam/phpipam version 1.5.2. This vulnerability allows an attacker
	to inject malicious scripts into the application, which are then
	executed in the context of other users who view the affected pages.
	The issue occurs when editing the NAT destination address, where user
	input is not properly sanitized. This can lead to data theft, account
	compromise, and other malicious activities. The vulnerability is fixed
	in version 1.7.0.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2024-10725</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2024-10725</url>
    </references>
    <dates>
      <discovery>2025-03-20</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>