TI-2026-27288 CVE-2026-35087 · GHSA-74x7-73gr-c646
Authentication Bypass in Slican telephone exchanges
Priority MEDIUM 49
Slican telephone exchanges allow administrative protocol authentication bypass.
Slican
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
Slican records in CISA KEVNo Slican vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2025-13318 CVE-2025-14577 · GHSA-266v-99c5-7x8c
PHP Function Injection in Slican NPC/IPL/IPM/IPU
Priority MEDIUM 48
Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection.
TI-2026-27289 CVE-2026-35089 · GHSA-pch2-h8hc-84fh
Use of Weak Credentials in Slican telephone exchanges
Priority MEDIUM 44
In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authentication.
TI-2026-27290 CVE-2026-35090 · GHSA-4fcp-hv44-rggc
Authentication Bypass in Slican telephone exchanges
Priority MEDIUM 43
In Slican telephone exchanges it is possible to manage the control panel remotely.
Priority LOW 39
WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint.
Priority LOW 35
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext.
Priority LOW 34
Slican telephone exchanges use symmetric encryption for TCP/IP communication.
TI-2021-20855 CVE-2021-45813 · GHSA-7v5f-6mfx-4g37
SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability.
Priority LOW 28
SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability.