PT-2026-25562 · Undefined · Undefined

Rodtvs + 1 · Published 2026-03-15 · Updated 2026-03-16 · CVE-2026-4189

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpipam versions up to 1.7.4

Description A weakness exists in phpipam that could allow for SQL injection. The issue is located in an unknown function within the app/admin/sections/edit-result.php file of the Section Handler component. Manipulating the subnetOrdering argument can trigger the SQL injection. The attack can be launched remotely, and an exploit is publicly available. The vendor was contacted regarding this issue but did not respond.

Recommendations Versions prior to 1.7.4 should be updated.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-4189

Affected Products

Undefined

References · 8

• 🔥 https://drive.google.com/file/d/1yxx2iUTG1ebMKo3W9bHlCFFxUJAhkwEk/view?usp=drive_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4189 · Security Note
• https://t.me/CVEtracker/47463 · Telegram Post
• https://vuldb.com/?submit.769933 · Note
• https://twitter.com/CVEnew/status/2033361068966252864 · Twitter Post
• https://vuldb.com/?id.351095 · Note
• https://twitter.com/cyberbivash/status/2033280016797118464 · Twitter Post
• https://vuldb.com/?ctiid.351095 · Note