{"id":"CVE-2026-115981","title":"phpIPAM index.php cross site scripting","summary":"A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The…","severity":"low","cvss":2.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-79","CWE-94"],"product":"phpIPAM","affected":["phpIPAM 1.8.0","phpIPAM 1.8.1","phpIPAM 1.8.2","phpIPAM 1.8.3"],"published":"2026-10-24","updated":"2026-10-24","sourceUpdated":"2026-10-24T21:45:07.713Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115981","references":[{"url":"https://vuldb.com/vuln/426075","label":"VDB-426075 | phpIPAM index.php cross site scripting"},{"url":"https://vuldb.com/vuln/426075/cti","label":"VDB-426075 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-115981","label":"CVE-2026-115981 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/983034","label":"Submit #983034 | phpIPAM 1.7.4/1.8.0/1.8.1/1.8.2/1.8.3 Cross Site Scripting"},{"url":"https://gist.github.com/KHr00t/f9351510717a5dac4797920fe532fe1e"}],"tags":["cve.org"],"ingestedAt":"2026-10-24T22:06:28.394Z","slug":"CVE-2026-115981","body":"## Overview\n\nA security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.\n\n## Affected\n\n- `phpIPAM 1.8.0`\n- `phpIPAM 1.8.1`\n- `phpIPAM 1.8.2`\n- `phpIPAM 1.8.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":13,"depthScoreParts":{"impact":13.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}