VULNERABILITY INTELLIGENCE

CVE-2022-23045

CVSS score4.8 MEDIUM

EPSS probability0.62%

CISA KEVNot currently listed

Published2022-01-19

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The "Site title" setting is injected in several locations which triggers the XSS.

Weakness classification

nvd@nist.gov: CWE-79

Primary references

help@fluidattacks.com — Exploit, Third Party Advisory
help@fluidattacks.com — Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory