CVE-2019-16692

🗓️ 22 Sep 2019 14:58:54Reported by mitreType

cve🔗 web.nvd.nist.gov👁 187 Views🌐 WEB

phpIPAM 1.4 SQL injection via table paramete

Reporter	Title	Published	Views	Family All 22
zdt	phpIPAM 1.4 - SQL Injection Vulnerability	30 Sep 201900:00	–	zdt
GithubExploit	Exploit for SQL Injection in Phpipam	27 Sep 201913:18	–	githubexploit
BDU FSTEC	The vulnerability of the app/admin/custom-fields/filter-result.php web application for managing IP addresses in phpipam allows a violator to execute arbitrary SQL queries.	23 Jun 202100:00	–	bdu_fstec
Circl	CVE-2019-16692	11 Oct 202421:55	–	circl
Check Point Advisories	SQL Servers Time-based SQL Injection (CVE-2011-4710; CVE-2019-13978; CVE-2019-16065; CVE-2019-16119; CVE-2019-16383; CVE-2019-16692; CVE-2020-15468; CVE-2020-26518; CVE-2020-29284; CVE-2021-21915; CVE-2021-21916; CVE-2021-21917; CVE-2022-23337; CVE-2022-25149)	26 May 201400:00	–	checkpoint_advisories
Cvelist	CVE-2019-16692	22 Sep 201914:58	–	cvelist
Exploit DB	phpIPAM 1.4 - SQL Injection	30 Sep 201900:00	–	exploitdb
exploitpack	phpIPAM 1.4 - SQL Injection	30 Sep 201900:00	–	exploitpack
Kitploit	CVE-2019-16692	4 Sep 202616:11	–	kitploit
NVD	CVE-2019-16692	22 Sep 201915:15	–	nvd

NVD

Node

phpipam phpipamRange≤1.4

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/154651/phpIPAM-1.4-SQL-Injection.html
github	www.github.com/phpipam/phpipam/issues/2738

Parameter	Position	Path	Description	CWE
action	request body	app/admin/custom-fields/filter-result.php	SQL injection via the table parameter in filter-result.php when action=add allows injection/exfiltration using updatexml-based payloads.	CWE-89
table	request body	app/admin/custom-fields/filter-result.php	SQL injection via the table parameter in filter-result.php when action=add allows injection/exfiltration using updatexml-based payloads.	CWE-89

17 Jun 2026 02:22Current

9.8High risk

Vulners AI Score9.8

CVSS 27.5

CVSS 3.19.8

EPSS0.10318

cve-2019-16692 phpipam 1.4 sql injection nvd