{"id":"CVE-2021-46426","details":"phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.","modified":"2026-08-07T17:28:15.505848Z","published":"2022-03-25T16:15:09.363Z","references":[{"type":"WEB","url":"https://www.tempest.com.br"},{"type":"ADVISORY","url":"http://seclists.org/fulldisclosure/2022/May/43"},{"type":"ADVISORY","url":"https://github.com/phpipam"},{"type":"FIX","url":"https://github.com/phpipam/phpipam/commit/6c1f72816d6ac634e9c174057e008717d959f351"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/167227/PHPIPAM-1.4.4-Cross-Site-Request-Forgery-Cross-Site-Scripting.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/phpipam/phpipam","events":[{"introduced":"a14bc06ed6412be21b36f30a2139945c4fb792fe"},{"last_affected":"a14bc06ed6412be21b36f30a2139945c4fb792fe"},{"fixed":"6c1f72816d6ac634e9c174057e008717d959f351"}],"database_specific":{"extracted_events":[{"introduced":"1.4.4"},{"last_affected":"1.4.4"}],"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:phpipam:phpipam:1.4.4:*:*:*:*:*:*:*"}}],"versions":["1.4.4","v1.4.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-46426.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}