{"schema_version":"2","view":"grouped","data":[{"id":56345,"cve_ids":["CVE-2026-115981"],"payload":{"kind":"advisory","title":"phpIPAM index.php cross site scripting","summary":"A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","evidence":"cve:CVE-2026-115981","products":[{"name":{"value":"phpIPAM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115981","aliases":["CVE-2026-115981"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*"],"vendor":"n/a","product":"phpIPAM","versions":[{"status":"affected","version":"1.8.0"},{"status":"affected","version":"1.8.1"},{"status":"affected","version":"1.8.2"},{"status":"affected","version":"1.8.3"}]}],"modified":"2026-10-24T21:45:07.713Z","provider":"cve","references":["https://vuldb.com/vuln/426075","https://vuldb.com/vuln/426075/cti","https://vuldb.com/cve/CVE-2026-115981","https://vuldb.com/submit/983034","https://gist.github.com/KHr00t/f9351510717a5dac4797920fe532fe1e"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T21:45:07.713Z"}}},"related_cves":[{"value":"CVE-2026-115981","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c19e72ab-079b-4d30-8827-3834d8cec6fc","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115981","advisory_id":"c19e72ab-079b-4d30-8827-3834d8cec6fc","event_types":["advisory"],"published_at":"2026-10-25T16:13:07.481695+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T21:45:07.713+00:00","detail_url":"/advisories/advisory%3Ac19e72ab-079b-4d30-8827-3834d8cec6fc","group":{"id":"advisory:c19e72ab-079b-4d30-8827-3834d8cec6fc","revision":1,"primary_event_id":55868,"change":"published","superseded_by":[],"changed":{"id":55868,"cve_ids":["CVE-2026-115981"],"payload":{"kind":"advisory","title":"phpIPAM index.php cross site scripting","summary":"A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","evidence":"cve:CVE-2026-115981","products":[{"name":{"value":"phpIPAM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115981","aliases":["CVE-2026-115981"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*"],"vendor":"n/a","product":"phpIPAM","versions":[{"status":"affected","version":"1.8.0"},{"status":"affected","version":"1.8.1"},{"status":"affected","version":"1.8.2"},{"status":"affected","version":"1.8.3"}]}],"modified":"2026-10-24T21:45:07.713Z","provider":"cve","references":["https://vuldb.com/vuln/426075","https://vuldb.com/vuln/426075/cti","https://vuldb.com/cve/CVE-2026-115981","https://vuldb.com/submit/983034","https://gist.github.com/KHr00t/f9351510717a5dac4797920fe532fe1e"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T21:45:07.713Z"}}},"related_cves":[{"value":"CVE-2026-115981","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c19e72ab-079b-4d30-8827-3834d8cec6fc","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115981","advisory_id":"c19e72ab-079b-4d30-8827-3834d8cec6fc","event_types":["advisory"],"published_at":"2026-10-25T16:13:07.481695+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T21:45:07.713+00:00","detail_url":"/events/55868"},"members":[{"id":55868,"cve_ids":["CVE-2026-115981"],"payload":{"kind":"advisory","title":"phpIPAM index.php cross site scripting","summary":"A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","evidence":"cve:CVE-2026-115981","products":[{"name":{"value":"phpIPAM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115981","aliases":["CVE-2026-115981"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*"],"vendor":"n/a","product":"phpIPAM","versions":[{"status":"affected","version":"1.8.0"},{"status":"affected","version":"1.8.1"},{"status":"affected","version":"1.8.2"},{"status":"affected","version":"1.8.3"}]}],"modified":"2026-10-24T21:45:07.713Z","provider":"cve","references":["https://vuldb.com/vuln/426075","https://vuldb.com/vuln/426075/cti","https://vuldb.com/cve/CVE-2026-115981","https://vuldb.com/submit/983034","https://gist.github.com/KHr00t/f9351510717a5dac4797920fe532fe1e"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T21:45:07.713Z"}}},"related_cves":[{"value":"CVE-2026-115981","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c19e72ab-079b-4d30-8827-3834d8cec6fc","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115981","advisory_id":"c19e72ab-079b-4d30-8827-3834d8cec6fc","event_types":["advisory"],"published_at":"2026-10-25T16:13:07.481695+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T21:45:07.713+00:00","detail_url":"/events/55868"}]}},{"id":56344,"cve_ids":["CVE-2026-115982"],"payload":{"kind":"advisory","title":"phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting","summary":"A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","evidence":"cve:CVE-2026-115982","products":[{"name":{"value":"phpIPAM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115982","aliases":["CVE-2026-115982"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*"],"vendor":"n/a","modules":["Rack Link Creation"],"product":"phpIPAM","versions":[{"status":"affected","version":"1.8.0"},{"status":"affected","version":"1.8.1"},{"status":"affected","version":"1.8.2"},{"status":"affected","version":"1.8.3"}]}],"modified":"2026-10-24T22:00:13.102Z","provider":"cve","references":["https://vuldb.com/vuln/426076","https://vuldb.com/vuln/426076/cti","https://vuldb.com/cve/CVE-2026-115982","https://vuldb.com/submit/983231","https://gist.github.com/KHr00t/a7f3b2eea71d30ad7ccf65e1d47e502f"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T22:00:13.102Z"}}},"related_cves":[{"value":"CVE-2026-115982","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ed74cd13-2624-4e9a-9727-7c69f89a679a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115982","advisory_id":"ed74cd13-2624-4e9a-9727-7c69f89a679a","event_types":["advisory"],"published_at":"2026-10-25T16:13:06.824884+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T22:00:13.102+00:00","detail_url":"/advisories/advisory%3Aed74cd13-2624-4e9a-9727-7c69f89a679a","group":{"id":"advisory:ed74cd13-2624-4e9a-9727-7c69f89a679a","revision":1,"primary_event_id":55867,"change":"published","superseded_by":[],"changed":{"id":55867,"cve_ids":["CVE-2026-115982"],"payload":{"kind":"advisory","title":"phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting","summary":"A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","evidence":"cve:CVE-2026-115982","products":[{"name":{"value":"phpIPAM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115982","aliases":["CVE-2026-115982"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*"],"vendor":"n/a","modules":["Rack Link Creation"],"product":"phpIPAM","versions":[{"status":"affected","version":"1.8.0"},{"status":"affected","version":"1.8.1"},{"status":"affected","version":"1.8.2"},{"status":"affected","version":"1.8.3"}]}],"modified":"2026-10-24T22:00:13.102Z","provider":"cve","references":["https://vuldb.com/vuln/426076","https://vuldb.com/vuln/426076/cti","https://vuldb.com/cve/CVE-2026-115982","https://vuldb.com/submit/983231","https://gist.github.com/KHr00t/a7f3b2eea71d30ad7ccf65e1d47e502f"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T22:00:13.102Z"}}},"related_cves":[{"value":"CVE-2026-115982","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ed74cd13-2624-4e9a-9727-7c69f89a679a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115982","advisory_id":"ed74cd13-2624-4e9a-9727-7c69f89a679a","event_types":["advisory"],"published_at":"2026-10-25T16:13:06.824884+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T22:00:13.102+00:00","detail_url":"/events/55867"},"members":[{"id":55867,"cve_ids":["CVE-2026-115982"],"payload":{"kind":"advisory","title":"phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting","summary":"A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","evidence":"cve:CVE-2026-115982","products":[{"name":{"value":"phpIPAM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115982","aliases":["CVE-2026-115982"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*"],"vendor":"n/a","modules":["Rack Link Creation"],"product":"phpIPAM","versions":[{"status":"affected","version":"1.8.0"},{"status":"affected","version":"1.8.1"},{"status":"affected","version":"1.8.2"},{"status":"affected","version":"1.8.3"}]}],"modified":"2026-10-24T22:00:13.102Z","provider":"cve","references":["https://vuldb.com/vuln/426076","https://vuldb.com/vuln/426076/cti","https://vuldb.com/cve/CVE-2026-115982","https://vuldb.com/submit/983231","https://gist.github.com/KHr00t/a7f3b2eea71d30ad7ccf65e1d47e502f"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T22:00:13.102Z"}}},"related_cves":[{"value":"CVE-2026-115982","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ed74cd13-2624-4e9a-9727-7c69f89a679a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115982","advisory_id":"ed74cd13-2624-4e9a-9727-7c69f89a679a","event_types":["advisory"],"published_at":"2026-10-25T16:13:06.824884+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T22:00:13.102+00:00","detail_url":"/events/55867"}]}},{"id":17407,"cve_ids":["CVE-2026-108720"],"payload":{"kind":"advisory","title":"phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages","summary":"phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access.","evidence":"cve:CVE-2026-108720","products":[{"name":{"value":"phpipam","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108720","aliases":["CVE-2026-108720"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpipam","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"1.8.3"}],"packageURL":"pkg:github/phpipam/phpipam","defaultStatus":"unaffected"}],"modified":"2026-10-13T13:17:08.960Z","provider":"cve","references":["https://hackmd.io/@haind/phpipam-tools-cross-section-address-disclosure","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/customers/customer/objects/ipaddresses.php#L69-L110","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/locations/single-location.php#L129-L195","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/nat/nat_details.php#L16-L45","https://github.com/phpipam/phpipam","https://www.vulncheck.com/advisories/phpipam-through-1.8.3-missing-authorization-in-customers-locations-and-nat-pages"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108720","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T13:14:33.366495Z"}}}],"references":[{"url":"https://hackmd.io/@haind/phpipam-tools-cross-section-address-disclosure","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:17:08.960Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-11T12:19:31.281Z"}}},"related_cves":[{"value":"CVE-2026-108720","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:18575a8b-8c69-46a3-9cf0-fa5771188eb1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108720","advisory_id":"18575a8b-8c69-46a3-9cf0-fa5771188eb1","event_types":["advisory"],"published_at":"2026-10-25T01:31:01.210915+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T12:19:31.281+00:00","detail_url":"/advisories/advisory%3A18575a8b-8c69-46a3-9cf0-fa5771188eb1","group":{"id":"advisory:18575a8b-8c69-46a3-9cf0-fa5771188eb1","revision":1,"primary_event_id":17294,"change":"published","superseded_by":[],"changed":{"id":17294,"cve_ids":["CVE-2026-108720"],"payload":{"kind":"advisory","title":"phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages","summary":"phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access.","evidence":"cve:CVE-2026-108720","products":[{"name":{"value":"phpipam","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108720","aliases":["CVE-2026-108720"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpipam","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"1.8.3"}],"packageURL":"pkg:github/phpipam/phpipam","defaultStatus":"unaffected"}],"modified":"2026-10-13T13:17:08.960Z","provider":"cve","references":["https://hackmd.io/@haind/phpipam-tools-cross-section-address-disclosure","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/customers/customer/objects/ipaddresses.php#L69-L110","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/locations/single-location.php#L129-L195","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/nat/nat_details.php#L16-L45","https://github.com/phpipam/phpipam","https://www.vulncheck.com/advisories/phpipam-through-1.8.3-missing-authorization-in-customers-locations-and-nat-pages"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108720","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T13:14:33.366495Z"}}}],"references":[{"url":"https://hackmd.io/@haind/phpipam-tools-cross-section-address-disclosure","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:17:08.960Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-11T12:19:31.281Z"}}},"related_cves":[{"value":"CVE-2026-108720","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:18575a8b-8c69-46a3-9cf0-fa5771188eb1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108720","advisory_id":"18575a8b-8c69-46a3-9cf0-fa5771188eb1","event_types":["advisory"],"published_at":"2026-10-25T01:31:01.210915+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T12:19:31.281+00:00","detail_url":"/events/17294"},"members":[{"id":17294,"cve_ids":["CVE-2026-108720"],"payload":{"kind":"advisory","title":"phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages","summary":"phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access.","evidence":"cve:CVE-2026-108720","products":[{"name":{"value":"phpipam","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108720","aliases":["CVE-2026-108720"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpipam","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"1.8.3"}],"packageURL":"pkg:github/phpipam/phpipam","defaultStatus":"unaffected"}],"modified":"2026-10-13T13:17:08.960Z","provider":"cve","references":["https://hackmd.io/@haind/phpipam-tools-cross-section-address-disclosure","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/customers/customer/objects/ipaddresses.php#L69-L110","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/locations/single-location.php#L129-L195","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/nat/nat_details.php#L16-L45","https://github.com/phpipam/phpipam","https://www.vulncheck.com/advisories/phpipam-through-1.8.3-missing-authorization-in-customers-locations-and-nat-pages"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108720","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T13:14:33.366495Z"}}}],"references":[{"url":"https://hackmd.io/@haind/phpipam-tools-cross-section-address-disclosure","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T13:17:08.960Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-11T12:19:31.281Z"}}},"related_cves":[{"value":"CVE-2026-108720","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:18575a8b-8c69-46a3-9cf0-fa5771188eb1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108720","advisory_id":"18575a8b-8c69-46a3-9cf0-fa5771188eb1","event_types":["advisory"],"published_at":"2026-10-25T01:31:01.210915+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-11T12:19:31.281+00:00","detail_url":"/events/17294"}]}},{"id":5431,"cve_ids":["CVE-2026-67602"],"payload":{"kind":"advisory","title":"phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache","summary":"phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.","evidence":"cve:CVE-2026-67602","products":[{"name":{"value":"phpipam","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-67602","aliases":["CVE-2026-67602"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpipam","versions":[{"status":"affected","version":"0","lessThan":"1.8.2","versionType":"semver"}],"packageURL":"pkg:github/phpipam/phpipam","defaultStatus":"affected"}],"modified":"2026-10-01T15:20:18.449Z","provider":"cve","references":["https://github.com/phpipam/phpipam/releases/tag/v1.8.2","https://github.com/phpipam/phpipam/commit/d29728fecca327f1ea825798908d0cfa4c62408e","https://www.vulncheck.com/advisories/phpipam-authentication-bypass-via-rest-api-object-cache"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-67602","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-24T18:49:39.217151Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-24T18:49:46.836Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:18.449Z"}}},"related_cves":[{"value":"CVE-2026-67602","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:def5ed42-b96b-4feb-9bf5-b6bae3b28bcb","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-67602","advisory_id":"def5ed42-b96b-4feb-9bf5-b6bae3b28bcb","event_types":["advisory"],"published_at":"2026-10-24T22:08:11.04999+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-24T13:57:42.191+00:00","detail_url":"/advisories/advisory%3Adef5ed42-b96b-4feb-9bf5-b6bae3b28bcb","group":{"id":"advisory:def5ed42-b96b-4feb-9bf5-b6bae3b28bcb","revision":1,"primary_event_id":5454,"change":"published","superseded_by":[],"changed":{"id":5454,"cve_ids":["CVE-2026-67602"],"payload":{"kind":"advisory","title":"phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache","summary":"phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.","evidence":"cve:CVE-2026-67602","products":[{"name":{"value":"phpipam","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-67602","aliases":["CVE-2026-67602"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpipam","versions":[{"status":"affected","version":"0","lessThan":"1.8.2","versionType":"semver"}],"packageURL":"pkg:github/phpipam/phpipam","defaultStatus":"affected"}],"modified":"2026-10-01T15:20:18.449Z","provider":"cve","references":["https://github.com/phpipam/phpipam/releases/tag/v1.8.2","https://github.com/phpipam/phpipam/commit/d29728fecca327f1ea825798908d0cfa4c62408e","https://www.vulncheck.com/advisories/phpipam-authentication-bypass-via-rest-api-object-cache"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-67602","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-24T18:49:39.217151Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-24T18:49:46.836Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:18.449Z"}}},"related_cves":[{"value":"CVE-2026-67602","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:def5ed42-b96b-4feb-9bf5-b6bae3b28bcb","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-67602","advisory_id":"def5ed42-b96b-4feb-9bf5-b6bae3b28bcb","event_types":["advisory"],"published_at":"2026-10-24T22:08:11.04999+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-24T13:57:42.191+00:00","detail_url":"/events/5454"},"members":[{"id":5454,"cve_ids":["CVE-2026-67602"],"payload":{"kind":"advisory","title":"phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache","summary":"phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.","evidence":"cve:CVE-2026-67602","products":[{"name":{"value":"phpipam","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-67602","aliases":["CVE-2026-67602"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpipam","versions":[{"status":"affected","version":"0","lessThan":"1.8.2","versionType":"semver"}],"packageURL":"pkg:github/phpipam/phpipam","defaultStatus":"affected"}],"modified":"2026-10-01T15:20:18.449Z","provider":"cve","references":["https://github.com/phpipam/phpipam/releases/tag/v1.8.2","https://github.com/phpipam/phpipam/commit/d29728fecca327f1ea825798908d0cfa4c62408e","https://www.vulncheck.com/advisories/phpipam-authentication-bypass-via-rest-api-object-cache"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-67602","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-24T18:49:39.217151Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-24T18:49:46.836Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-01T15:20:18.449Z"}}},"related_cves":[{"value":"CVE-2026-67602","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:def5ed42-b96b-4feb-9bf5-b6bae3b28bcb","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-67602","advisory_id":"def5ed42-b96b-4feb-9bf5-b6bae3b28bcb","event_types":["advisory"],"published_at":"2026-10-24T22:08:11.04999+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-24T13:57:42.191+00:00","detail_url":"/events/5454"}]}},{"id":2092,"cve_ids":["CVE-2026-97818"],"payload":{"kind":"advisory","title":"CVE-2026-97818","summary":"phpIPAM through 1.8.3 has incorrect authorization for id==\"admins\" and id==\"all\" in api/controllers/User.php.","evidence":"cve:CVE-2026-97818","products":[{"name":{"value":"phpIPAM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97818","aliases":["CVE-2026-97818"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpIPAM","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"1.8.3"}],"programFiles":["api/controllers/User.php"],"defaultStatus":"unknown"}],"modified":"2026-09-25T13:53:51.123Z","provider":"cve","references":["https://github.com/phpipam/phpipam/releases/tag/v1.8.3","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/api/controllers/User.php#L143-L146"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97818","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T13:53:40.833250Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T13:53:51.123Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-09-25T04:44:18.843Z"}}},"related_cves":[{"value":"CVE-2026-97818","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:62c148d3-4e20-46cc-859a-d7073e68af55","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97818","advisory_id":"62c148d3-4e20-46cc-859a-d7073e68af55","event_types":["advisory"],"published_at":"2026-10-24T21:12:54.596961+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:44:18.843+00:00","detail_url":"/advisories/advisory%3A62c148d3-4e20-46cc-859a-d7073e68af55","group":{"id":"advisory:62c148d3-4e20-46cc-859a-d7073e68af55","revision":1,"primary_event_id":2091,"change":"published","superseded_by":[],"changed":{"id":2091,"cve_ids":["CVE-2026-97818"],"payload":{"kind":"advisory","title":"CVE-2026-97818","summary":"phpIPAM through 1.8.3 has incorrect authorization for id==\"admins\" and id==\"all\" in api/controllers/User.php.","evidence":"cve:CVE-2026-97818","products":[{"name":{"value":"phpIPAM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97818","aliases":["CVE-2026-97818"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpIPAM","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"1.8.3"}],"programFiles":["api/controllers/User.php"],"defaultStatus":"unknown"}],"modified":"2026-09-25T13:53:51.123Z","provider":"cve","references":["https://github.com/phpipam/phpipam/releases/tag/v1.8.3","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/api/controllers/User.php#L143-L146"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97818","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T13:53:40.833250Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T13:53:51.123Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-09-25T04:44:18.843Z"}}},"related_cves":[{"value":"CVE-2026-97818","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:62c148d3-4e20-46cc-859a-d7073e68af55","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97818","advisory_id":"62c148d3-4e20-46cc-859a-d7073e68af55","event_types":["advisory"],"published_at":"2026-10-24T21:12:54.596961+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:44:18.843+00:00","detail_url":"/events/2091"},"members":[{"id":2091,"cve_ids":["CVE-2026-97818"],"payload":{"kind":"advisory","title":"CVE-2026-97818","summary":"phpIPAM through 1.8.3 has incorrect authorization for id==\"admins\" and id==\"all\" in api/controllers/User.php.","evidence":"cve:CVE-2026-97818","products":[{"name":{"value":"phpIPAM","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97818","aliases":["CVE-2026-97818"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpIPAM","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"1.8.3"}],"programFiles":["api/controllers/User.php"],"defaultStatus":"unknown"}],"modified":"2026-09-25T13:53:51.123Z","provider":"cve","references":["https://github.com/phpipam/phpipam/releases/tag/v1.8.3","https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/api/controllers/User.php#L143-L146"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-97818","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T13:53:40.833250Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T13:53:51.123Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-09-25T04:44:18.843Z"}}},"related_cves":[{"value":"CVE-2026-97818","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:62c148d3-4e20-46cc-859a-d7073e68af55","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97818","advisory_id":"62c148d3-4e20-46cc-859a-d7073e68af55","event_types":["advisory"],"published_at":"2026-10-24T21:12:54.596961+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T04:44:18.843+00:00","detail_url":"/events/2091"}]}},{"id":975,"cve_ids":["CVE-2026-75105"],"payload":{"kind":"advisory","title":"phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter","summary":"phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).","evidence":"cve:CVE-2026-75105","products":[{"name":{"value":"phpipam","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-75105","aliases":["CVE-2026-75105"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpipam","versions":[{"status":"affected","version":"0","lessThan":"1.8.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T14:19:18.272Z","provider":"cve","references":["https://github.com/phpipam/phpipam/issues/4623","https://github.com/phpipam/phpipam","https://github.com/phpipam/phpipam/commit/2980be03652c0eb1db9fe2bcefaa210c854b9aea","https://github.com/phpipam/phpipam/releases/tag/v1.8.2","https://www.vulncheck.com/advisories/phpipam-temporary-subnet-share-information-disclosure-via-address-parameter"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-75105","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-20T13:48:29.426806Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-20T15:24:35.690Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:19:18.272Z"}}},"related_cves":[{"value":"CVE-2026-75105","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e178cabb-0caa-4715-adea-76eb31c8c5a6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-75105","advisory_id":"e178cabb-0caa-4715-adea-76eb31c8c5a6","event_types":["advisory"],"published_at":"2026-10-24T20:54:25.077121+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-17T20:36:01.403+00:00","detail_url":"/advisories/advisory%3Ae178cabb-0caa-4715-adea-76eb31c8c5a6","group":{"id":"advisory:e178cabb-0caa-4715-adea-76eb31c8c5a6","revision":1,"primary_event_id":969,"change":"published","superseded_by":[],"changed":{"id":969,"cve_ids":["CVE-2026-75105"],"payload":{"kind":"advisory","title":"phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter","summary":"phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).","evidence":"cve:CVE-2026-75105","products":[{"name":{"value":"phpipam","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-75105","aliases":["CVE-2026-75105"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpipam","versions":[{"status":"affected","version":"0","lessThan":"1.8.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T14:19:18.272Z","provider":"cve","references":["https://github.com/phpipam/phpipam/issues/4623","https://github.com/phpipam/phpipam","https://github.com/phpipam/phpipam/commit/2980be03652c0eb1db9fe2bcefaa210c854b9aea","https://github.com/phpipam/phpipam/releases/tag/v1.8.2","https://www.vulncheck.com/advisories/phpipam-temporary-subnet-share-information-disclosure-via-address-parameter"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-75105","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-20T13:48:29.426806Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-20T15:24:35.690Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:19:18.272Z"}}},"related_cves":[{"value":"CVE-2026-75105","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e178cabb-0caa-4715-adea-76eb31c8c5a6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-75105","advisory_id":"e178cabb-0caa-4715-adea-76eb31c8c5a6","event_types":["advisory"],"published_at":"2026-10-24T20:54:25.077121+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-17T20:36:01.403+00:00","detail_url":"/events/969"},"members":[{"id":969,"cve_ids":["CVE-2026-75105"],"payload":{"kind":"advisory","title":"phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter","summary":"phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).","evidence":"cve:CVE-2026-75105","products":[{"name":{"value":"phpipam","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-75105","aliases":["CVE-2026-75105"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/phpipam/phpipam","vendor":"phpipam","product":"phpipam","versions":[{"status":"affected","version":"0","lessThan":"1.8.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-24T14:19:18.272Z","provider":"cve","references":["https://github.com/phpipam/phpipam/issues/4623","https://github.com/phpipam/phpipam","https://github.com/phpipam/phpipam/commit/2980be03652c0eb1db9fe2bcefaa210c854b9aea","https://github.com/phpipam/phpipam/releases/tag/v1.8.2","https://www.vulncheck.com/advisories/phpipam-temporary-subnet-share-information-disclosure-via-address-parameter"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-75105","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-20T13:48:29.426806Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-20T15:24:35.690Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:19:18.272Z"}}},"related_cves":[{"value":"CVE-2026-75105","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e178cabb-0caa-4715-adea-76eb31c8c5a6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-75105","advisory_id":"e178cabb-0caa-4715-adea-76eb31c8c5a6","event_types":["advisory"],"published_at":"2026-10-24T20:54:25.077121+00:00","technologies":["core-cve","phpipam"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-17T20:36:01.403+00:00","detail_url":"/events/969"}]}}],"next_after":56345,"next_before":975}