CVE-2026-115981
phpIPAM index.php cross site scripting
CVSS v3.1 (listed by NVD)
2.4
LOW
Scored by vuldb.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0 (listed by NVD)
1.9
LOW
Scored by vuldb.com (not yet scored by NVD)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
4.8
MEDIUM
Scored by CNA (VulDB) · v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkAdminUser action
PoC
Confidentiality NIntegrity LAvailability N
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | H | Administrator |
| User interaction UI | R | Required |
| Scope S | U | Unchanged |
| Confidentiality C | N | None |
| Integrity I | L | Low |
| Availability A | N | None |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Description
NVD
A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 4.0 | 1.9 LOW | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD / [email protected] (Primary) | 3.1 | 2.4 LOW | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N |
| NVD / [email protected] (Secondary) | 2.0 | 3.3 LOW | AV:N/AC:L/Au:M/C:N/I:P/A:N |
| CNA / VulDB | 4.0 | 4.8 MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA / VulDB | 3.1 | 2.4 LOW | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C |
| CNA / VulDB | 3.0 | 2.4 LOW | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C |
| CNA / VulDB | 2.0 | 3.3 | AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| n/a | phpIPAM | affected: 1.8.0 affected: 1.8.1 affected: 1.8.2 affected: 1.8.3 |
Linux distribution status
References (5)
- https://gist.github.com/KHr00t/f9351510717a5dac4797920fe532fe1e NVD, CNA exploit
- https://vuldb.com/cve/CVE-2026-115981 NVD, CNA third-party-advisory
- https://vuldb.com/submit/983034 NVD, CNA third-party-advisory
- https://vuldb.com/vuln/426075 NVD, CNA vdb-entrytechnical-description
- https://vuldb.com/vuln/426075/cti NVD, CNA signaturepermissions-required