CVE-2026-19764
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to version 7.6.5 in the file /app/users/getpwd.php. Manipulation of the argument sip leads to SQL injection. The attack can be executed remotely, and the exploit is publicly available.
Risk Assessment
A remote attacker can exploit SQL injection to gain unauthorized access to the database, steal data, modify data, or escalate privileges within the system.
Recommendation
Update the platform to the latest version if a patch is available. If not, restrict access to getpwd.php and monitor logs for suspicious queries.
Original NVD description (English source)
A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.