Which versions of PHP are affected by CVE-2026-4815?

Organizations using Support Board face significant risk from CVE-2026-4815, a SQL injection vulnerability rated CVSS 8.7.. A patch is available.

How to fix or mitigate CVE-2026-4815?

Within 7 days: Identify all affected systems running Support Board and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2026-4815

Q: What is the CVSS score of CVE-2026-4815?

CVE-2026-4815 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-15415 HIGH

SQL Injection (CWE-89)

2026-03-25 INCIBE

GHSA-4wj4-5pg3-mprq

SQLi PHP

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 14:00 euvd

EUVD-2026-15415

Analysis Generated

Mar 25, 2026 - 14:00 vuln.today

Patch released

Mar 25, 2026 - 14:00 nvd

Patch available

CVE Published

Mar 25, 2026 - 13:31 nvd

HIGH 8.7

DescriptionCVE.org

A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls[0][message_ids][]' parameter in '/supportboard/include/ajax.php' endpoint.

AnalysisAI

Unauthenticated attackers can exploit SQL injection in Support Board v3.7.7's AJAX endpoint to fully compromise the application database through the calls[0][message_ids][] parameter, enabling complete data exfiltration and manipulation. The vulnerability requires only low privileges and network access, with no user interaction needed, making it trivially exploitable in multi-tenant environments. A patch is available and should be applied immediately given the HIGH severity rating and complete database access impact.

Technical ContextAI

This vulnerability is rooted in improper input validation and parameterization in PHP code handling AJAX requests. The Support Board application (affected CPE: cpe:2.3:a:schiocco:support_board:*:*:*:*:*:*:*:*) fails to properly sanitize or use prepared statements for the 'calls[0][message_ids][]' parameter before incorporating it into SQL queries. This is a classic CWE-89 (SQL Injection) vulnerability where user-supplied input is concatenated directly into SQL statements without escaping or parameterized query mechanisms. The AJAX endpoint at '/supportboard/include/ajax.php' acts as a backend handler that processes array-based parameters, making it a common target for parameter-based injection attacks in PHP web applications.

RemediationAI

Apply the security patch provided by Schiocco as referenced in the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-support-board-schiocco immediately. Upgrade Support Board to a patched version released after the disclosure of this vulnerability. Until patching is completed, implement network-level access controls to restrict access to the '/supportboard/include/ajax.php' endpoint to trusted sources only, disable or password-protect the AJAX endpoint if not critical to operations, and implement a Web Application Firewall (WAF) with SQL injection detection rules to monitor and block suspicious parameter payloads containing SQL syntax. Additionally, ensure database user accounts running the Support Board application operate with minimal required privileges (no DROP or ALTER TABLE permissions) to limit the scope of damage from successful exploitation.