CVE-2025-60912 Cross-site request forgery in n/a

Low 3.3 Published 8 Dec 2025 Updated 8 Dec 2025

Remote attackers can force administrators to download database dumps via CSRF, exposing sensitive network data.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-60912?

CVE-2025-60912 is a low-severity vulnerability in Phpipam Phpipam, published on 8 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an administrator has an active session.

Weakness: CWE-352

Which versions are affected by CVE-2025-60912?

It affects 1 product.

Products include Phpipam Phpipam.

How do I fix CVE-2025-60912?

No fix has been published for CVE-2025-60912 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-60912 being exploited?

There is no known exploitation of CVE-2025-60912 in the wild and no public exploit code.

All Phpipam Phpipam vulnerabilities

Sources

Also known as GHSA-2j22-hr4w-47gj.