Live › vulnerability › CVE-2026-115982
Go to dashboardphpIPAM up to 1.8.3 does not sanitize the deviceid argument in the Rack Link Creation function of app/tools/racks/show-rack-popup.php. An attacker can inject script that runs in the browser of a user who opens the crafted link or page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 22:46 UTC. All times on this page are UTC.
Any team running phpIPAM 1.8.3 or earlier with the rack feature in use is exposed. Installations that do not use the rack tools, or that are not reachable by untrusted users, carry less risk.
No product ranges from the sources yet.
1.8.3.app/tools/racks/show-rack-popup.php in the installation and check whether it passes deviceid into output without escaping.1.8.3 once the vendor ships a fix (unknown if one is available yet).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-115982")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.