CVE-2026-115981

Deferred Deferred - Pending Action

Cross-Site Scripting in phpIPAM via REQUEST_URI

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: VulDB

Description

A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-24

Last Modified

2026-10-24

Generated

2026-10-25

AI Q&A

2026-10-25

EPSS Evaluated

N/A

NVD

CVE-2026-115981

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	phpIPAM	1.8.0
n/a	phpIPAM	1.8.1
n/a	phpIPAM	1.8.2
n/a	phpIPAM	1.8.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in phpIPAM versions up to 1.8.3. It involves manipulation of the REQUEST_URI argument in the upgrade/index.php file, allowing attackers to inject malicious scripts. The exploit is publicly disclosed and can be launched remotely.

Detection Guidance

This vulnerability involves a reflected cross-site scripting (XSS) flaw in phpIPAM up to version 1.8.3 via manipulation of the REQUEST_URI argument in upgrade/index.php. To detect it, inspect web server logs for unusual URI parameters containing script tags or payloads targeting XSS. Check for requests to upgrade/index.php with suspicious query strings.

Impact Analysis

An attacker could exploit this to execute malicious scripts in a user's browser, potentially stealing session cookies, credentials, or sensitive data. It may also enable phishing attacks or defacement of the phpIPAM interface.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information if exploited in healthcare environments.

Mitigation Strategies

Immediately upgrade phpIPAM to the latest version beyond 1.8.3 to patch the vulnerability. If upgrading is not possible, restrict access to the upgrade/index.php file via web server configuration (e.g., Apache or Nginx rules). Monitor network traffic for exploitation attempts and apply input validation to sanitize URI parameters.

Hi! I’m here to help you understand CVE-2026-115981. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70