GCVE - cpe:2.3:a:phpipam:phpipam:1.4.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:phpipam:phpipam:1.4.4:*:*:*:*:*:*:*

part: a version: 1.4.4 update: *

Vendor	Phpipam (`36f32332-aad9-5c0f-92dd-c6fa39ebf918`)
Product	Phpipam (`9e6a234a-2b3d-58b5-8e92-84eeed6f2eef`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/bertramtruong/phpipam`	purl2cpe	2026-06-01 10:12:43.582495
`pkg:github/phpipam/phpipam`	purl2cpe	2026-06-01 10:12:43.582497
`pkg:rpm/opensuse/phpipam`	purl2cpe	2026-06-01 10:12:43.582499
`pkg:sourceforge/phpipam`	purl2cpe	2026-06-01 10:12:43.582500

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-23046`	vulnerable	2026-06-08 05:40:56.076348	Details available PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php Published: 2022-01-19T20:38:56.000Z Updated: 2024-08-03T03:28:42.952Z Open on db.gcve.eu Reference links https://fluidattacks.com/advisories/mercury/ https://github.com/phpipam/phpipam/releases/tag/v1.4.5 http://packetstormsecurity.com/files/165683/PHPIPAM-1.4.4-SQL-Injection.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-23045`	vulnerable	2026-06-08 05:40:56.075910	Details available PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The "Site title" setting is injected in several locations which triggers the XSS. Published: 2022-01-19T20:38:57.000Z Updated: 2024-08-03T03:28:43.083Z Open on db.gcve.eu Reference links https://github.com/phpipam/phpipam/releases/tag/v1.4.5 https://fluidattacks.com/advisories/osbourne/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-46426`	vulnerable	2026-06-08 05:38:03.366898	Details available phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality. Published: 2022-03-25T15:54:12.000Z Updated: 2024-08-04T05:02:11.522Z Open on db.gcve.eu Reference links https://www.tempest.com.br https://github.com/phpipam https://github.com/phpipam/phpipam/commit/6c1f72816d6ac634e9c174057e008717d959f351 http://seclists.org/fulldisclosure/2022/May/43 http://packetstormsecurity.com/files/167227/PHPIPAM-1.4.4-Cross-Site-Request-Forgery-Cross-Site-Scripting.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.