Search
Find a vulnerability
Search criteria
4 vulnerabilities found for ipl-web by Icinga
CVE-2026-42224 (GCVE-0-2026-42224)
Vulnerability from nvd – Published: 2026-05-08 22:02 – Updated: 2026-06-09 10:44
VLAI
EPSS
VEX
Title
ipl/web is vulnerable to reflected XSS by malformed search requests
Summary
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Icinga/ipl-web/security/adviso… | x_refsource_CONFIRM |
| https://github.com/Icinga/ipl-web/commit/f387e925… | x_refsource_MISC |
| https://github.com/Icinga/ipl-web/releases/tag/v0.10.3 | x_refsource_MISC |
| https://github.com/Icinga/ipl-web/releases/tag/v0.13.1 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42224",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T15:58:24.417193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T15:58:31.300Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ipl-web",
"vendor": "Icinga",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.11.0, \u003c 0.13.1"
},
{
"status": "affected",
"version": "\u003c 0.10.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim\u0027s browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T10:44:43.005Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Icinga/ipl-web/security/advisories/GHSA-55wf-5m3q-6jjf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Icinga/ipl-web/security/advisories/GHSA-55wf-5m3q-6jjf"
},
{
"name": "https://github.com/Icinga/ipl-web/commit/f387e92504d7a03bb857d1aee9b7410e06dd065d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Icinga/ipl-web/commit/f387e92504d7a03bb857d1aee9b7410e06dd065d"
},
{
"name": "https://github.com/Icinga/ipl-web/releases/tag/v0.10.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Icinga/ipl-web/releases/tag/v0.10.3"
},
{
"name": "https://github.com/Icinga/ipl-web/releases/tag/v0.13.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Icinga/ipl-web/releases/tag/v0.13.1"
}
],
"source": {
"advisory": "GHSA-55wf-5m3q-6jjf",
"discovery": "UNKNOWN"
},
"title": "ipl/web is vulnerable to reflected XSS by malformed search requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42224",
"datePublished": "2026-05-08T22:02:52.231Z",
"dateReserved": "2026-04-25T05:37:12.116Z",
"dateUpdated": "2026-06-09T10:44:43.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-41811 (GCVE-0-2024-41811)
Vulnerability from nvd – Published: 2024-08-05 20:17 – Updated: 2024-08-06 13:53
VLAI
EPSS
VEX
Title
ipl/web susceptible to Cross-Site Request Forgery (CSRF)
Summary
ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Icinga/ipl-web/security/adviso… | x_refsource_CONFIRM |
| https://github.com/Icinga/ipl-web/commit/492336fd… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41811",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T13:53:22.612388Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T13:53:56.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ipl-web",
"vendor": "Icinga",
"versions": [
{
"status": "affected",
"version": "\u003c 0.10.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T20:17:30.849Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j"
},
{
"name": "https://github.com/Icinga/ipl-web/commit/492336fdb57a5bb0881ed642ab36f5841337571e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Icinga/ipl-web/commit/492336fdb57a5bb0881ed642ab36f5841337571e"
}
],
"source": {
"advisory": "GHSA-w9pg-7c3h-fc8j",
"discovery": "UNKNOWN"
},
"title": "ipl/web susceptible to Cross-Site Request Forgery (CSRF)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-41811",
"datePublished": "2024-08-05T20:17:30.849Z",
"dateReserved": "2024-07-22T13:57:37.136Z",
"dateUpdated": "2024-08-06T13:53:56.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-42224 (GCVE-0-2026-42224)
Vulnerability from cvelistv5 – Published: 2026-05-08 22:02 – Updated: 2026-06-09 10:44
VLAI
EPSS
VEX
Title
ipl/web is vulnerable to reflected XSS by malformed search requests
Summary
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Icinga/ipl-web/security/adviso… | x_refsource_CONFIRM |
| https://github.com/Icinga/ipl-web/commit/f387e925… | x_refsource_MISC |
| https://github.com/Icinga/ipl-web/releases/tag/v0.10.3 | x_refsource_MISC |
| https://github.com/Icinga/ipl-web/releases/tag/v0.13.1 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42224",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T15:58:24.417193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T15:58:31.300Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ipl-web",
"vendor": "Icinga",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.11.0, \u003c 0.13.1"
},
{
"status": "affected",
"version": "\u003c 0.10.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim\u0027s browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T10:44:43.005Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Icinga/ipl-web/security/advisories/GHSA-55wf-5m3q-6jjf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Icinga/ipl-web/security/advisories/GHSA-55wf-5m3q-6jjf"
},
{
"name": "https://github.com/Icinga/ipl-web/commit/f387e92504d7a03bb857d1aee9b7410e06dd065d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Icinga/ipl-web/commit/f387e92504d7a03bb857d1aee9b7410e06dd065d"
},
{
"name": "https://github.com/Icinga/ipl-web/releases/tag/v0.10.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Icinga/ipl-web/releases/tag/v0.10.3"
},
{
"name": "https://github.com/Icinga/ipl-web/releases/tag/v0.13.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Icinga/ipl-web/releases/tag/v0.13.1"
}
],
"source": {
"advisory": "GHSA-55wf-5m3q-6jjf",
"discovery": "UNKNOWN"
},
"title": "ipl/web is vulnerable to reflected XSS by malformed search requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42224",
"datePublished": "2026-05-08T22:02:52.231Z",
"dateReserved": "2026-04-25T05:37:12.116Z",
"dateUpdated": "2026-06-09T10:44:43.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-41811 (GCVE-0-2024-41811)
Vulnerability from cvelistv5 – Published: 2024-08-05 20:17 – Updated: 2024-08-06 13:53
VLAI
EPSS
VEX
Title
ipl/web susceptible to Cross-Site Request Forgery (CSRF)
Summary
ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Icinga/ipl-web/security/adviso… | x_refsource_CONFIRM |
| https://github.com/Icinga/ipl-web/commit/492336fd… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41811",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T13:53:22.612388Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T13:53:56.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ipl-web",
"vendor": "Icinga",
"versions": [
{
"status": "affected",
"version": "\u003c 0.10.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF). All affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded. Version 0.10.1 includes a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T20:17:30.849Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j"
},
{
"name": "https://github.com/Icinga/ipl-web/commit/492336fdb57a5bb0881ed642ab36f5841337571e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Icinga/ipl-web/commit/492336fdb57a5bb0881ed642ab36f5841337571e"
}
],
"source": {
"advisory": "GHSA-w9pg-7c3h-fc8j",
"discovery": "UNKNOWN"
},
"title": "ipl/web susceptible to Cross-Site Request Forgery (CSRF)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-41811",
"datePublished": "2024-08-05T20:17:30.849Z",
"dateReserved": "2024-07-22T13:57:37.136Z",
"dateUpdated": "2024-08-06T13:53:56.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}