What is the CVSS score of CVE-2025-61078?

CVE-2025-61078 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

phpIPAM CVE-2025-61078

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-09 cve@mitre.org

XSS PHP Phpipam

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated injection via public form (PR:N, AV:N), admin must view result (UI:R), script executes in admin browser crossing trust boundary (S:C); no server availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 04:19 vuln.today

DescriptionNVD

Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructions parameter for the /app/admin/instructions/edit-result.php endpoint.

AnalysisAI

Stored or reflected cross-site scripting in phpIPAM v1.7.3 enables remote unauthenticated attackers to inject malicious JavaScript into the Request IP form via the instructions parameter, which is subsequently rendered in the admin-facing /app/admin/instructions/edit-result.php endpoint. When an authenticated administrator views the affected page, the injected script executes in their browser session, potentially enabling session token theft, credential harvesting, or unauthorized administrative actions. No public exploit identified at time of analysis, though a technical disclosure post exists at glitch0ne.com; EPSS of 0.22% at the 13th percentile confirms low opportunistic exploitation pressure.

Technical ContextAI

phpIPAM (cpe:2.3:a:phpipam:phpipam:1.7.3:*:*:*:*:*:*:*) is an open-source PHP-based IP address management application widely deployed by network and IT teams for subnet tracking and IP request workflows. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input from the Request IP form - specifically the instructions parameter - is not properly sanitized or encoded before being reflected or stored and later rendered in the admin result view at /app/admin/instructions/edit-result.php. The CVSS scope-changed flag (S:C) indicates the injected script executes in the browser context of the viewing administrator, crossing the trust boundary between the unauthenticated submission surface and the privileged admin interface. This is a classic CWE-79 pattern in PHP applications that render user-controlled data without htmlspecialchars() or equivalent output encoding.

RemediationAI

No vendor-released patch identified at time of analysis - the only reference is a third-party researcher disclosure with no corresponding official phpIPAM advisory or patched release version. As an immediate compensating control, restrict access to the /app/admin/instructions/edit-result.php endpoint and the IP request submission form to trusted internal networks via web server access controls (e.g., Apache Require ip, nginx allow/deny directives), accepting the trade-off that external IP request submission will be blocked. Additionally, implement a Content Security Policy (CSP) header such as Content-Security-Policy: default-src 'self'; script-src 'self' to limit script execution scope - note this may break legitimate inline scripts. Operators should monitor phpIPAM's GitHub repository (https://github.com/phpipam/phpipam) and official site (https://phpipam.net) for a patched release addressing CVE-2025-61078 and upgrade immediately upon release.