High severity · published Oct 15, 2026
CVE-2026-63314
SQL Injection in WebCTI
8.7
CVSS
0.2%
EPSS
No
On KEV
Description
WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.
This issue was fixed in IPx series version 6.62.0100.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
IPx · Slican
before 6.62.0100 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63314
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63314
cert.pl
https://cert.pl/posts/2026/10/CVE-2026-35088
www.slican.pl
https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/
More from IPx
9.3
CVE-2026-35087
Authentication Bypass in Slican telephone exchanges
8.7
CVE-2026-35089
Use of Weak Credentials in Slican telephone exchanges
8.2
CVE-2026-63315
Plaintext storage of a password in WebCTI
8.2
CVE-2026-35088
Inadequate Encryption Strength in Slican telephone exchanges