# cve.now: Phpipam

The newest entries naming Phpipam as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108720](https://cve.now/CVE-2026-108720.md): phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages (CVSS 5.3)
- [CVE-2026-97818](https://cve.now/CVE-2026-97818.md): phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php. (CVSS 8.6)
- [CVE-2026-67602](https://cve.now/CVE-2026-67602.md): phpIPAM \< 1.8.2 Authentication Bypass via REST API Object Cache (CVSS 9.3)
- [CVE-2026-75105](https://cve.now/CVE-2026-75105.md): phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter (CVSS 8.7)
- [CVE-2026-12194](https://cve.now/CVE-2026-12194.md): PHPIPAM Authenticated LFI (CVSS 2.3)
- [CVE-2024-55093](https://cve.now/CVE-2024-55093.md): phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts. (CVSS 5.4)
- [CVE-2024-10721](https://cve.now/CVE-2024-10721.md): Store XSS in phpipam/phpipam (CVSS 3.5)
- [CVE-2024-10727](https://cve.now/CVE-2024-10727.md): Cross-Site Scripting (XSS) in phpipam/phpipam (CVSS 3.5)
- [CVE-2024-10720](https://cve.now/CVE-2024-10720.md): Stored Cross-site Scripting (XSS) in phpipam/phpipam (CVSS 8.2)
- [CVE-2024-10722](https://cve.now/CVE-2024-10722.md): Stored Cross-site Scripting (XSS) in phpipam/phpipam (CVSS 3.5)
- [CVE-2024-10719](https://cve.now/CVE-2024-10719.md): Stored Cross-site Scripting (XSS) in phpipam/phpipam (CVSS 2.4)
- [CVE-2024-10718](https://cve.now/CVE-2024-10718.md): Cookie without Secure attribute in phpipam/phpipam (CVSS 5.3)
- [CVE-2024-10724](https://cve.now/CVE-2024-10724.md): Stored XSS in IPV6 Section in phpipam/phpipam (CVSS 3.5)
- [CVE-2024-10723](https://cve.now/CVE-2024-10723.md): Stored XSS in phpipam/phpipam (CVSS 3.5)
- [CVE-2024-10725](https://cve.now/CVE-2024-10725.md): Stored Cross-site Scripting (XSS) in phpipam/phpipam (CVSS 3.5)
- [CVE-2022-1226](https://cve.now/CVE-2022-1226.md): Cross-site Scripting (XSS) in phpipam/phpipam (CVSS 3.5)
- [CVE-2024-0787](https://cve.now/CVE-2024-0787.md): Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam (CVSS 5.3)
- [CVE-2023-1212](https://cve.now/CVE-2023-1212.md): Cross-site Scripting (XSS) - Stored in phpipam/phpipam (CVSS 5.9)
- [CVE-2023-1211](https://cve.now/CVE-2023-1211.md): SQL Injection in phpipam/phpipam (CVSS 7.2)
- [CVE-2023-0678](https://cve.now/CVE-2023-0678.md): Missing Authorization in phpipam/phpipam (CVSS 7.5)
- [CVE-2023-0677](https://cve.now/CVE-2023-0677.md): Cross-site Scripting (XSS) - Reflected in phpipam/phpipam (CVSS 4.4)
- [CVE-2023-0676](https://cve.now/CVE-2023-0676.md): Cross-site Scripting (XSS) - Reflected in phpipam/phpipam (CVSS 2.4)
- [CVE-2022-1225](https://cve.now/CVE-2022-1225.md): Incorrect Privilege Assignment in phpipam/phpipam (CVSS 6.5)
- [CVE-2022-1223](https://cve.now/CVE-2022-1223.md): Incorrect Authorization in phpipam/phpipam (CVSS 6.5)
- [CVE-2022-1224](https://cve.now/CVE-2022-1224.md): Improper Authorization in phpipam/phpipam (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/phpipam
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.