High severity · published Oct 15, 2026
CVE-2026-63315
Plaintext storage of a password in WebCTI
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.
This issue was fixed in IPx series version 6.62.0100.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
IPx · Slican
before 6.62.0100 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63315
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63315
cert.pl
https://cert.pl/posts/2026/08/CVE-2026-63314
www.slican.pl
https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/
More from IPx
9.3
CVE-2026-35087
Authentication Bypass in Slican telephone exchanges
8.7
CVE-2026-63314
SQL Injection in WebCTI
8.7
CVE-2026-35089
Use of Weak Credentials in Slican telephone exchanges
8.2
CVE-2026-35088
Inadequate Encryption Strength in Slican telephone exchanges