VulnerabilityAnalyzed
CVE-2025-60912
phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality.
LOW 3.3EPSS 0.20%
Does this matter?
Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.
Description
phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an administrator has an active session.
- CVSS 3.1
- 3.3 LOWCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L
- EPSS
- 0.20% probability · 10th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- phpipam/phpipam
- Source
- cve@mitre.org
References
- https://gist.github.com/amandrei/a8377d9b71c55156d22aaaf485463d15Third Party Advisory
- https://github.com/phpipam/phpipamProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.