p PatchFirst

CVE-2026-42224

CVE-2026-42224 · ipl/web is vulnerable to reflected XSS by malformed search requests

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.

CVSS 7.6 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • ipl-web

    Versions
    • >= 0.11.0, < 0.13.1: Affected
    • < 0.10.3: Affected

    No fix published

  • ipl/web Packagist

    Versions
    • 0.11.0
    • v0.11.1
    • v0.12.0
    • v0.13.0
    Affected ranges
    • ECOSYSTEM: ≥ 0.11.0, < 0.13.1

    Update to 0.13.1

  • ipl/web Packagist

    Versions
    • v0.1.0
    • v0.10.0
    • v0.10.1
    • v0.10.2
    • v0.2.0
    • v0.2.1
    • v0.3.0
    • v0.4.0
    • v0.5.0
    • v0.6.0
    • v0.7.0
    • v0.7.1
    • v0.8.0
    • v0.9.0
    • v0.9.1
    • v0.9.2
    Affected ranges
    • ECOSYSTEM: < 0.10.3

    Update to 0.10.3

Original sources

Check your server →