| Package | Affected versions | Patched versions |
|---|---|---|
| phpipam | < 1.7.0 | 1.7.0 |
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability occurs in the 'Device Management' section under 'Administration' where an attacker can inject malicious scripts into the 'Name' and 'Description' fields when adding a new device type. This can lead to data theft, account compromise, distribution of malware, website defacement, and phishing attacks. The issue is fixed in version 1.7.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free