CVE-2022-1226

A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include import-vlan-preview.php, import-subnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-preview.php, and import-l2dom-preview.php. The vulnerability can be exploited by uploading a specially crafted spreadsheet file containing malicious JavaScript payloads, which are then executed in the context of the victim's browser. This can lead to defacement of websites, execution of malicious JavaScript code, stealing of user cookies, and unauthorized access to user accounts.

• CWE-79

• https://github.com/phpipam/phpipam/commit/50e36b9e4fff5eaa51dc6e42bc684748da378002Patch
• https://huntr.com/bounties/3fdcf653-fe26-4592-94a1-98ce664618ecExploit, Third Party Advisory

Published

Nov 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1220The FoxyShop WordPress plugin before 4.8.2 does not sanitise…6.1
• CVE-2022-1221The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 …6.1
• CVE-2022-1222Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV.5.5
• CVE-2022-1223Incorrect Authorization in GitHub repository phpipam/phpipam…6.5
• CVE-2022-1224Improper Authorization in GitHub repository phpipam/phpipam …6.5
• CVE-2022-1225Incorrect Privilege Assignment in GitHub repository phpipam/…6.5
• CVE-2022-1227A privilege escalation flaw was found in Podman. This flaw a…8.8
• CVE-2022-1228The Opensea WordPress plugin before 1.0.3 does not sanitize …4.8
• CVE-2022-1229This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-1230This vulnerability allows local attackers to execute arbitra…3.9
• CVE-2022-1231XSS via Embedded SVG in SVG Diagram Format in GitHub reposit…6.1
• CVE-2022-1232Type confusion in V8 in Google Chrome prior to 100.0.4896.75…8.8