CVE-2026-115982
phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting
CVSS v3.1 (listed by NVD)
4.3
MEDIUM
Scored by vuldb.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0 (listed by NVD)
2.1
LOW
Scored by vuldb.com (not yet scored by NVD)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
5.3
MEDIUM
Scored by CNA (VulDB) · v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkNo authUser action
PoC
Confidentiality NIntegrity LAvailability N
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | N | None |
| User interaction UI | R | Required |
| Scope S | U | Unchanged |
| Confidentiality C | N | None |
| Integrity I | L | Low |
| Availability A | N | None |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Description
NVD
A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 4.0 | 2.1 LOW | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD / [email protected] (Primary) | 3.1 | 4.3 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| NVD / [email protected] (Secondary) | 2.0 | 5.0 MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| CNA / VulDB | 4.0 | 5.3 MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA / VulDB | 3.1 | 4.3 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C |
| CNA / VulDB | 3.0 | 4.3 MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C |
| CNA / VulDB | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| n/a | phpIPAM | affected: 1.8.0 affected: 1.8.1 affected: 1.8.2 affected: 1.8.3 |
Linux distribution status
References (5)
- https://gist.github.com/KHr00t/a7f3b2eea71d30ad7ccf65e1d47e502f NVD, CNA exploit
- https://vuldb.com/cve/CVE-2026-115982 NVD, CNA third-party-advisory
- https://vuldb.com/submit/983231 NVD, CNA third-party-advisory
- https://vuldb.com/vuln/426076 NVD, CNA vdb-entrytechnical-description
- https://vuldb.com/vuln/426076/cti NVD, CNA signaturepermissions-required