Medium severity · published Mar 20, 2025
CVE-2024-10727
Cross-Site Scripting (XSS) in phpipam/phpipam
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0. The vulnerability arises when the application receives data in an HTTP request and includes that data within the immediate response in an unsafe manner. This allows an attacker to execute arbitrary JavaScript in the context of the user's browser, potentially leading to full compromise of the user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
phpipam/phpipam · phpipam
before 1.7.0 · source: vendor
PH
Phpipam · Phpipam
1.5.0 through 1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10727
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10727
Patch
https://github.com/phpipam/phpipam/commit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731
Exploit
https://huntr.com/bounties/259eed22-4d6f-4229-92e5-04674f302d5d
More from phpipam/phpipam
7.5
CVE-2024-10718
Cookie without Secure attribute in phpipam/phpipam
6.1
CVE-2024-10720
Stored Cross-site Scripting (XSS) in phpipam/phpipam
5.9
CVE-2024-0787
Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam
5.4
CVE-2024-10721
Store XSS in phpipam/phpipam
5.4
CVE-2024-10722
Stored Cross-site Scripting (XSS) in phpipam/phpipam