Vulnerability Details CVE-2025-60912
phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an administrator has an active session.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 10.0%
CVSS Severity
CVSS v3 Score 3.3
References
Products affected by CVE-2025-60912
-
cpe:2.3:a:phpipam:phpipam:-
-
cpe:2.3:a:phpipam:phpipam:0.1
-
cpe:2.3:a:phpipam:phpipam:0.2
-
cpe:2.3:a:phpipam:phpipam:0.3
-
cpe:2.3:a:phpipam:phpipam:0.4
-
cpe:2.3:a:phpipam:phpipam:0.5
-
cpe:2.3:a:phpipam:phpipam:0.6
-
cpe:2.3:a:phpipam:phpipam:0.7
-
cpe:2.3:a:phpipam:phpipam:0.8
-
cpe:2.3:a:phpipam:phpipam:0.9
-
cpe:2.3:a:phpipam:phpipam:1.0
-
cpe:2.3:a:phpipam:phpipam:1.1
-
cpe:2.3:a:phpipam:phpipam:1.1.010
-
cpe:2.3:a:phpipam:phpipam:1.2
-
cpe:2.3:a:phpipam:phpipam:1.3
-
cpe:2.3:a:phpipam:phpipam:1.3.1
-
cpe:2.3:a:phpipam:phpipam:1.3.2
-
cpe:2.3:a:phpipam:phpipam:1.4
-
cpe:2.3:a:phpipam:phpipam:1.4.1
-
cpe:2.3:a:phpipam:phpipam:1.4.2
-
cpe:2.3:a:phpipam:phpipam:1.4.3
-
cpe:2.3:a:phpipam:phpipam:1.4.4
-
cpe:2.3:a:phpipam:phpipam:1.4.5
-
cpe:2.3:a:phpipam:phpipam:1.4.6
-
cpe:2.3:a:phpipam:phpipam:1.4.7
-
cpe:2.3:a:phpipam:phpipam:1.5.0
-
cpe:2.3:a:phpipam:phpipam:1.5.1
-
cpe:2.3:a:phpipam:phpipam:1.5.2
-
cpe:2.3:a:phpipam:phpipam:1.6
-
cpe:2.3:a:phpipam:phpipam:1.7.0
-
cpe:2.3:a:phpipam:phpipam:1.7.1
-
cpe:2.3:a:phpipam:phpipam:1.7.3