CVE-2026-63314: SQL Injection in WebCTI

Q: Which deployments need to be remediated?

Slican WebCTI deployments used with Slican IPx telephone exchanges should be updated if they run an IPx series version earlier than 6.62.0100. The issue is fixed in version 6.62.0100.

Q: What level of access does an attacker need?

An attacker must be authenticated to the WebCTI service. The vulnerable endpoint is /webcti/admin_json.php.

Published Oct 15, 2026

Updated

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/adminjson.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.

This issue was fixed in IPx series version 6.62.0100.

Affected Software

1 affected component

SLICAN WebCTI<6.62.0100

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Slican IPx WebCTI to a version that resolves this vulnerability.
Fixed in 6.62.0100

Event History

Oct 15, 2026

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments need to be remediated?

Slican WebCTI deployments used with Slican IPx telephone exchanges should be updated if they run an IPx series version earlier than 6.62.0100. The issue is fixed in version 6.62.0100.

What level of access does an attacker need?

An attacker must be authenticated to the WebCTI service. The vulnerable endpoint is /webcti/admin_json.php.