CVE-2026-5553
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In itsourcecode Online Cellphone System 1.0, a SQL injection vulnerability was found in the file /cp/available.php via manipulation of the Name argument. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
An attacker can execute arbitrary SQL queries, potentially leading to data leakage or system takeover.
Recommendation
Immediately implement parameterized SQL queries or prepared statements in available.php and restrict access to this file.
Original NVD description (English source)
A vulnerability was identified in itsourcecode Online Cellphone System 1.0. Affected by this vulnerability is an unknown functionality of the file /cp/available.php of the component Parameter Handler. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.