CVE-2024-41357 is a high-severity Cross-Site Scripting (XSS) vulnerability affecting phpipam version 1.6, specifically within the /app/admin/powerDNS/record-edit.php component. An unauthenticated attacker can exploit this with low complexity by tricking a user into interacting with a malicious link, potentially leading to limited impact on confidentiality, integrity, and availability. While not currently in CISA's KEV catalog or showing active exploitation, a public exploit (EDB-52442) exists, though community discussion and media coverage remain minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.6CPE matchmatch criteria | cpe:2.3:a:phpipam:phpipam:1.6:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.