Which versions of PHP are affected by CVE-2026-4189?

Organizations using phpipam should be aware of moderate risk from CVE-2026-4189, a SQL injection vulnerability rated CVSS 4.7.

Is there a public PoC exploit available for CVE-2026-4189?

Yes, a public proof-of-concept exploit is available for CVE-2026-4189. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4189?

Within 30 days: Identify affected systems running phpipam and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4189

Q: What is the CVSS score of CVE-2026-4189?

CVE-2026-4189 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12249 LOW

SQL Injection (CWE-89)

2026-03-15 VulDB

PHP SQLi Phpipam N A

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 15, 2026 - 20:00 euvd

EUVD-2026-12249

Analysis Generated

Mar 15, 2026 - 20:00 vuln.today

CVE Published

Mar 15, 2026 - 19:32 nvd

MEDIUM 4.7

DescriptionCVE.org

A weakness has been identified in phpipam up to 1.7.4. The impacted element is an unknown function of the file app/admin/sections/edit-result.php of the component Section Handler. Executing a manipulation of the argument subnetOrdering can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in phpIPAM versions up to 1.7.4 allows authenticated administrators to manipulate the subnetOrdering parameter in the Section Handler component, enabling remote database compromise. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early disclosure notification.

Technical ContextAI

The vulnerability is rooted in CWE-89 (SQL Injection), a classic input validation failure where user-controlled input is concatenated directly into SQL queries without proper parameterization or escaping. phpipam is a PHP-based IP address management system that uses a database backend to store network configuration data. The affected component, the Section Handler in edit-result.php, processes administrative requests related to network section management. The attack vector is network-based and requires high-privilege authentication, suggesting this is an authenticated SQL injection vulnerability rather than a pre-authentication flaw. The vulnerability likely stems from dynamic SQL query construction using user input from the subnetOrdering parameter without prepared statements or parameterized queries, which is a common pattern in legacy PHP applications.

RemediationAI

Organizations using phpipam should immediately upgrade to a patched version beyond 1.7.4 once available from the official phpipam project repository. If an immediate patch is unavailable from the vendor due to non-responsiveness, implement network-level access controls to restrict access to phpipam administrative interfaces to trusted IP ranges only, enforce strong authentication mechanisms (multi-factor authentication if supported), and implement database-level access restrictions to limit the scope of SQL injection impact. Additionally, review database user permissions to ensure the phpipam database user operates with the principle of least privilege (avoiding GRANT ALL or data deletion permissions). Apply Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the subnetOrdering parameter. Monitor database query logs for suspicious SQL activity as a compensating control until patching is completed.