All vulnerabilities
CVE-2026-63314

IPx: SQL Injection in WebCTI

Slican IPx
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.62.0100Fixed versionCVE List
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.

This issue was fixed in IPx series version 6.62.0100.

Text from CVE List

Affected versions 1

  • IPxaffected: all versions before 6.62.0100CVE List

References 2