Is CVE-2025-61078 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-61078 being exploited in the wild.

How severe is CVE-2025-61078?

Medium severity, with a CVSS score of 6.1, published 9 December 2025.

Is there a fix for CVE-2025-61078?

A patch was published on 2025-11-17: Fix committed to v1.7 and v1.8 branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-61078 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-61078?

Check whether you run Phpipam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61078: phpIPAM cross-site scripting in Request IP form instructions

CVE-2025-61078 · Severity: medium · CVSS 6.1 · Published 2025-12-09

phpIPAM, an open-source IP address management application, contains a security flaw in its Request IP form. An attacker can inject malicious scripts into the instructions field, which are then executed when a legitimate user interacts with the page. This could lead to the theft of sensitive information, such as user credentials or session tokens, potentially compromising the management of the organization's network infrastructure.

Technologies: Phpipam. Vendors: Phpipam.

Quick answers

Is CVE-2025-61078 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-61078 being exploited in the wild.
How severe is CVE-2025-61078?: Medium severity, with a CVSS score of 6.1, published 9 December 2025.
Which products and versions are affected?: Phpipam 1.7.3 and earlier.
Is there a fix for CVE-2025-61078?: A patch was published on 2025-11-17: Fix committed to v1.7 and v1.8 branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61078 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-61078?: Check whether you run Phpipam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in phpIPAM versions up to and including 1.7.3. The flaw is located in the /app/admin/instructions/edit-result.php endpoint, where the 'instructions' parameter fails to properly neutralize user-supplied input. An authenticated attacker can submit a crafted POST request containing malicious HTML or JavaScript (such as javascript: pseudo-protocol tags within form buttons). When a victim navigates to the Request IP page and interacts with the injected element, the script executes in the context of the victim's session. This can be used to exfiltrate sensitive data like usernames and passwords. The issue is addressed in version 1.7.4 and the v1.8 branch.

Affected products

phpIPAM phpIPAM 1.7.3 and earlier

Timeline

2025-09-02: disclosed: Vendor notified
2025-11-17: patched: Fix committed to v1.7 and v1.8 branches
2025-11-27: patched: Version 1.7.4 released
2025-12-05: advisory: Public disclosure by researcher
2025-12-09: advisory: NVD published date

References

https://glitch0ne.com/2025/12/05/cve-2025-61078-cross-site-scripting-xss-vulnerability-in-request-ip-form-in-phpipam-v1-7-3/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.