phpIPAM CVE-2026-115981

Exploitation requires (1) high-privilege/administrative authentication to reach the upgrade/index.php endpoint (PR:H), and (2) user interaction - a victim must follow an attacker-crafted request whose REQUEST_URI value is reflected without sanitization (UI:P). The flaw is reflected XSS, not stored, so each exploitation needs a fresh lured request rather than a persistent payload. Limiting factors that reduce realistic risk: the attacker must already possess high privileges on the target instance, a separate user must be induced to act, impact is confined to low integrity (no data disclosure or service disruption per VC:N/VA:N), and the affected path is an upgrade utility rather than a routinely-used page. This is not a remote-unauthenticated issue against default configurations.

This is a low-priority issue, and the signals are consistent in saying so. The CVSS 4.0 base score is 1.9 (Low), and the vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) shows why: although the flaw is reachable over the network with low complexity, it requires high privileges (PR:H) and user interaction (UI:P), and its only impact is low integrity (VI:L) with no confidentiality or availability effect - consistent with a reflected cross-site scripting (CWE-79) bug. The vuln.today decision label is 'monitor', the exploit maturity is only E:P (proof-of-concept), and the lone exploit reference is a public gist that the input marks as 'not verified as working exploit code'. No EPSS score and no KEV listing were provided; absence of those is not evidence of risk here. There is no conflict among the signals: a high-privilege, user-interaction-dependent reflected XSS that yields only low integrity impact is a genuinely low-severity finding, not a high-CVSS-but-overrated one. The main caveat is sourcing - all data traces to a single reporter (VulDB) with no independent vendor advisory, so affected-version and trigger details are not corroborated.

An attacker who already holds high-privilege (administrative) access to a phpIPAM instance crafts a URL to upgrade/index.php whose REQUEST_URI carries a script payload, then lures an authenticated user into following it; the value is reflected unsanitized and the script runs in the victim's browser session. A public PoC reference exists (a gist) but the input notes it is not verified as working exploit code, so practical weaponization is unconfirmed. The requirement for both high privileges and victim interaction makes opportunistic exploitation unlikely.