phpIPAM CVE-2026-115982

Exploitation requires reaching the create_rack_link function in app/tools/racks/show-rack-popup.php (the Rack Link Creation component) and controlling the deviceid argument so that attacker-supplied content is reflected into the page without proper output encoding. Because this is reflected XSS, a victim must actively load the attacker-crafted input (UI:P in the CVSS vector), which limits exploitation to social-engineering delivery rather than silent mass exploitation. The CVSS vector states PR:N, but rack management is an authenticated operator feature in phpIPAM and the description does not confirm the endpoint is reachable pre-authentication - this prerequisite should be verified against the specific deployment. Impact is confined to the victim's browser session (no confidentiality or availability impact per the vector).

This is a low-severity reflected cross-site scripting issue (CWE-79) in phpIPAM, and the available signals are consistent in pointing to low real-world priority rather than an urgent threat. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) yields only 2.1: network-reachable and low-complexity, but it requires passive user interaction (UI:P) and produces only a low integrity impact with no confidentiality or availability impact - characteristic of XSS where script executes in a victim's browser. The vuln.today decision label is 'monitor', not act_now or emergency, which aligns with the low score. There is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or probable exploitation; absence of these signals is not itself a finding but means exploitation likelihood cannot be elevated. A public PoC reference (a GitHub gist) is listed but is explicitly not verified as working exploit code, so this is a weaker signal than confirmed exploit availability. One tension worth noting: the CVSS vector sets PR:N (unauthenticated), yet rack-link creation in phpIPAM is an operator-facing administrative feature - whether the vulnerable endpoint is reachable pre-authentication is not confirmed by the description and should be verified against the deployment. Overall this reads as a genuine but minor hygiene issue, not a high-priority emergency.

An attacker crafts a URL or form input that injects malicious JavaScript into the deviceid argument handled by create_rack_link in app/tools/racks/show-rack-popup.php, then lures an authenticated phpIPAM user into loading it. When the victim's browser renders the rack-link popup, the injected script runs in their session context, potentially performing actions as that user. A public PoC reference exists but is not verified as working exploit code, and successful exploitation depends on the victim interacting with the attacker-supplied input (UI:P).