CVE-2026-63314: Slican IPx SQL injection in WebCTI admin endpoint

CVE-2026-63314 · Severity: info · Published 2026-10-15

WebCTI is a web interface for Slican IPx telephone exchanges that allows authorized users to manage calls, contacts, and phone settings. An authenticated attacker can exploit improper input validation in the /webcti/admin_json.php endpoint to execute SQL injection attacks and potentially access or modify sensitive data stored in the telephone system's database.

Technologies: Slican IPx. Vendors: Slican.

Quick answers

Is CVE-2026-63314 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63314 being exploited in the wild.
How severe is CVE-2026-63314?
Informational severity, published 15 October 2026.
Which products and versions are affected?
Slican IPx before 6.62.0100.
Is there a fix for CVE-2026-63314?
Yes: fixed in IPx series version 6.62.0100. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63314 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-63314?
Check whether you run Slican IPx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: IPx series version 6.62.0100

Technical details

The vulnerability is a SQL injection flaw in the /webcti/admin_json.php endpoint of WebCTI for Slican IPx telephone exchanges. The issue arises from improper neutralization of user-supplied input, allowing an authenticated attacker with network access to the WebCTI interface to inject malicious SQL commands and bypass query logic.

Affected products

  • Slican IPx before 6.62.0100

Timeline

  • 2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.