CVE-2026-115982

phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting

View on CVE.org
Published Oct 24, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Analysis

AI-generated

Technical impact

The flaw exists in the function that creates rack links in phpIPAM. By manipulating the deviceid argument, an attacker can inject arbitrary JavaScript into the client’s browser when the page is rendered. This type of cross‑site scripting allows the attacker to conduct session hijacking, data theft, or malicious code execution within the victim’s session.

Affected Systems

Any installation of phpIPAM running the 1.8.3 release or earlier is affected. The vulnerability resides in the app/tools/racks/show‑rack‑popup.php component of the Rack Link Creation feature.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet documented. The exploit requires only a crafted HTTP request to the create_rack_link endpoint, making it remotely exploitable over the network. Attackers with access to the web interface or who can influence traffic to the target can immediately abuse the flaw.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade phpIPAM to a version that fixes the create_rack_link input handling or apply any patch referred to by the vendor.
  • If an update cannot be performed immediately, configure the web server or application firewall to reject or sanitize free‑form input on the deviceid parameter to eliminate unsanitized output.
  • Deploy a browser‑side XSS protection mechanism, such as Content‑Security‑Policy headers, to mitigate the impact of any remaining injection vectors.

Generated by OpenCVE AI on October 25, 2026 at 04:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Title phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting
First Time appeared Phpipam
Phpipam phpipam
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*
Vendors & Products Phpipam
Phpipam phpipam
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 6:29 PM
Reserved
Oct 24, 2026, 7:17 AM

View source JSON

Updated
Oct 29, 2026, 6:29 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 10:16 PM
Modified
Oct 29, 2026, 7:17 PM

View source JSON

No data.

Updated
Oct 25, 2026, 6:00 AM

JSON