CVE-2026-19764
Raisecom Communication Command and Dispatch Management Platform getpwd.php sql injection
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 14, 2026
- Updated
- Aug 14, 2026
- Reserved
- Aug 13, 2026
Description
A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Communication Command and Dispatch Management PlatformRaisecom |
|
References
- VDB-389667 | Raisecom Communication Command and Dispatch Management Platform getpwd.php sql injectionvdb-entrytechnical-description
- VDB-389667 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-19764 | CVE Analysis and Reportthird-party-advisory
- Submit #868986 | Raisecom Technology Co., Ltd. Raisecom Communication Command and Dispatch Management Platform 7.6.5 SQL Injectionthird-party-advisory
- https://my.feishu.cn/docx/S80ddLulfolH8WxDbUJcdrGAnbg?from=from_copylinkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.