CVE-2026-63314

HighCVSS 8.7

Published: 15/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

The WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in the /webcti/admin_json.php endpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.

Risk Assessment

An authenticated attacker can read or modify database data, potentially leading to information disclosure or integrity compromise.

Recommendation

Upgrade IPx exchanges to version 6.62.0100 or later, where the issue has been fixed.

Other vulnerabilities in Slican IPx WebCTI

CVE-2026-63315High
The WebCTI service for Slican IPx telephone exchanges stores temporary subscriber passwords in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.

Original NVD description (English source)

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS