PT-2026-25562 · Undefined · Undefined

Rodtvs + 1 · Publicado 2026-03-15 · Atualizado 2026-03-16 · CVE-2026-4189

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpipam versions up to 1.7.4

Description A weakness exists in phpipam that could allow for SQL injection. The issue is located in an unknown function within the app/admin/sections/edit-result.php file of the Section Handler component. Manipulating the subnetOrdering argument can trigger the SQL injection. The attack can be launched remotely, and an exploit is publicly available. The vendor was contacted regarding this issue but did not respond.

Recommendations Versions prior to 1.7.4 should be updated.

Exploit

Correção

SQL injection

Special Elements Injection

Enumeração de Fraquezas

CWE-89

CWE-74

Identificadores relacionados

CVE-2026-4189

Produtos afetados

Undefined

Referências · 8

• 🔥 https://drive.google.com/file/d/1yxx2iUTG1ebMKo3W9bHlCFFxUJAhkwEk/view?usp=drive_link · Exploit
• https://t.me/CVEtracker/47463 · Publicação no Telegram
• https://vuldb.com/?submit.769933 · Nota
• https://twitter.com/CVEnew/status/2033361068966252864 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4189 · Nota de Segurança
• https://vuldb.com/?id.351095 · Nota
• https://twitter.com/cyberbivash/status/2033280016797118464 · Publicação no Twitter
• https://vuldb.com/?ctiid.351095 · Nota