CVE-2021-35438

phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.

• CWE-79

• https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2021-35438.md
• https://github.com/phpipam/phpipam/issues/3351Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/phpipam/phpipam/issues/3351Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Jun 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35413A remote code execution (RCE) vulnerability in course_intro_…8.8
• CVE-2021-35414Chamilo LMS v1.11.x was discovered to contain a SQL injectio…9.8
• CVE-2021-35415A stored cross-site scripting (XSS) vulnerability allows att…4.8
• CVE-2021-3542Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-3543A flaw null pointer dereference in the Nitro Enclaves kernel…6.7
• CVE-2021-35437SQL injection vulnerability in LMXCMS v.1.4 allows attacker …9.8
• CVE-2021-3544Several memory leaks were found in the virtio vhost-user GPU…6.5
• CVE-2021-35440Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). …6.1
• CVE-2021-35448Emote Interactive Remote Mouse 3.008 on Windows allows attac…7.8
• CVE-2021-35449The Lexmark Universal Print Driver version 2.15.1.0 and belo…7.8
• CVE-2021-3545An information disclosure vulnerability was found in the vir…6.5
• CVE-2021-35450A Server Side Template Injection in the Entando Admin Consol…7.2