CVE-2026-63314

SQL Injection in WebCTI

State: Published
Severity: 8.7 High
Published: Oct 15, 2026
Updated: Oct 15, 2026
Reserved: Jul 16, 2026

Description

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.

This issue was fixed in IPx series version 6.62.0100.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	CERT-PL

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
IPxSlican	before 6.62.0100Affected

References

https://cert.pl/posts/2026/10/CVE-2026-35088third-party-advisory
https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.