{"id":"CVE-2021-46426","details":"phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.","modified":"2026-09-16T11:45:08.296318624Z","published":"2022-03-25T16:15:09.363Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:phpipam:phpipam:1.4.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.4.4"},{"last_affected":"1.4.4"}],"source":"CPE_STRING","vendor_product":"phpipam:phpipam"}]},"references":[{"type":"WEB","url":"https://www.tempest.com.br"},{"type":"ADVISORY","url":"http://seclists.org/fulldisclosure/2022/May/43"},{"type":"ADVISORY","url":"https://github.com/phpipam"},{"type":"FIX","url":"https://github.com/phpipam/phpipam/commit/6c1f72816d6ac634e9c174057e008717d959f351"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/167227/PHPIPAM-1.4.4-Cross-Site-Request-Forgery-Cross-Site-Scripting.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/phpipam/phpipam","events":[{"introduced":"0"},{"fixed":"6c1f72816d6ac634e9c174057e008717d959f351"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v1.3.2","v1.3.0","v1.2.0_beta2","v1.19.008","v1.16.003"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-46426.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}