medium6.1Public exploit code
CVE-2024-41358
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)2025-12-02 · webapps · php
Impact
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phpipam | Phpipam | Version 1.6 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2024-41358.md
- https://github.com/phpipam/phpipam/commit/3986ac1acfbf47ddd4fe05cd158aaf2cacafe36b
- https://github.com/phpipam/phpipam/commit/b131fb99c9ada95b38e4cb2749ac599e42fad3d9
- https://github.com/phpipam/phpipam/issues/4148