CVE-2026-63315highCWE-256

CVE-2026-63315: high-severity vulnerability in Slican IPx

Plaintext storage of a password in WebCTI

Published

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.3%
exploitation probability
0.3%top 80% of all CVEs
observed exploitation
nono source reports it
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series version 6.62.0100.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Slican · IPx
Related CVEs — Slican IPx

In the same product, most dangerous first.

CVE-2026-35087CRITICALAuthentication Bypass in Slican telephone exchangesEPSS 0.6%CVE-2026-35089HIGHUse of Weak Credentials in Slican telephone exchangesEPSS 0.6%CVE-2026-63314HIGHSQL Injection in WebCTIEPSS 0.2%CVE-2026-35088HIGHInadequate Encryption Strength in Slican telephone exchangesEPSS 0.1%
References
https://cert.pl/posts/2026/08/CVE-2026-63314https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta/