What’s Vulnerable › Vulnerabilities

CVE-2023-41580

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-02 · updated 2026-06-17
• Weakness: CWE-74

Description

Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.

Affected products

• phpipam/phpipam: before 1.5.2 — fixed in 1.5.2

How to fix

Upgrade to a fixed version: phpipam/phpipam 1.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/ehtec/phpipam-exploit
• https://github.com/phpipam/phpipam/commit/c451085476074943eb4056941005c0b61db566c5
• https://github.com/ehtec/phpipam-exploit
• https://github.com/phpipam/phpipam/commit/c451085476074943eb4056941005c0b61db566c5

Get alerted when CVE-2023-41580 or the next vulnerability affects your stack