# CVE-2025-60912: phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The…

Source: https://junglewise.ai/threats/cve-2025-60912-phpipam-v1-7-3-contains-a-cross-site-request-forgery-csrf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-08  
License: CC BY 4.0 with a link back

CVE-2025-60912 · Severity: low · CVSS 3.3 · Published 2025-12-08

phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an administrator has an active session.

Technologies: [Phpipam](https://junglewise.ai/threats/technologies/phpipam). Vendors: [Phpipam](https://junglewise.ai/threats/vendors/phpipam).

## Quick answers

**Is CVE-2025-60912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60912 being exploited in the wild.

**How severe is CVE-2025-60912?** Low severity, with a CVSS score of 3.3, published 8 December 2025.

**Which products and versions are affected?** Phpipam. The advisory does not name versions.

**Is there a fix for CVE-2025-60912?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-60912?** Check whether you run Phpipam. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Phpipam

## Related threats

- [phpIPAM reflected cross-site scripting in rack link creation](https://junglewise.ai/threats/cve-2026-115982-a-vulnerability-was-detected-in-phpipam-up-to-1-8-3-affected-by)
- [phpIPAM missing authorization check in customer pages](https://junglewise.ai/threats/cve-2026-108720-phpipam-through-1-8-3-contains-a-missing-authorization)
- [phpIPAM authorization bypass in User API controller](https://junglewise.ai/threats/cve-2026-97818-phpipam-through-1-8-3-has-incorrect-authorization-for-id-admins)
- [phpIPAM REST API authentication bypass via cache key collision](https://junglewise.ai/threats/cve-2026-67602-phpipam-rest-api-authentication-bypass-via-cache-key-collision)
- [phpIPAM authenticated local file inclusion in API](https://junglewise.ai/threats/cve-2026-12194-phpipam-authenticated-local-file-inclusion-in-api)