Azcall CVE-2026-15482

Q: What is the CVSS score of CVE-2026-15482?

CVE-2026-15482 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43204 MEDIUM

SQL Injection (CWE-89)

2026-07-12 VulDB

GHSA-vcv4-rr9v-fqr6

PHP SQLi Azcall

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable unauthenticated SQLi with no scope change; limited confidentiality, integrity, and availability impact consistent with constrained database account privileges.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 12, 2026 - 07:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 12, 2026 - 06:59 vuln.today

DescriptionCVE.org

A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /azcall/adm/gestao_loja/sis.php?t=consultar of the component HTTP Handler. Executing a manipulation of the argument nome/perfil/status can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Aster Telecom Azcall 10/11 exposes a network-reachable administrative endpoint to unauthenticated query manipulation via the nome, perfil, and status HTTP parameters in the store management handler. The CVSS 4.0 vector confirms no authentication or special prerequisites are required (AV:N/AC:L/PR:N/UI:N), and public exploit code is available (E:P). The vendor did not respond to coordinated disclosure, meaning no official patch exists at time of analysis.

Technical ContextAI

Azcall is a PHP-based telecom management platform developed by Aster Telecom (CPE: cpe:2.3:a:aster_telecom:azcall:*:*:*:*:*:*:*:*). The root cause is CWE-89 - Improper Neutralization of Special Elements in SQL Commands - a classic failure to sanitize user-controlled input before interpolating it into backend database queries, indicating the absence of parameterized queries or prepared statements. The vulnerable endpoint /azcall/adm/gestao_loja/sis.php appears to be an administrative interface for store or account management within the telecom platform. Three distinct parameters (nome, perfil, status) are each injectable, suggesting the vulnerability is systemic to that handler rather than isolated to a single code path.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. Operators of Azcall 10/11 should immediately restrict network access to the administrative path /azcall/adm/ at the firewall or web server level, limiting reachability to explicitly trusted internal IP ranges; this directly eliminates the AV:N attack vector and is the most effective compensating control. A web application firewall rule targeting SQL metacharacter injection (single quotes, UNION, comment sequences) in the nome, perfil, and status parameters can provide an additional detection and blocking layer, though WAF bypass remains possible with sufficiently obfuscated payloads. If the store management functionality at /azcall/adm/gestao_loja/sis.php is not operationally required, disabling or removing that endpoint entirely removes the attack surface without service impact. Monitor VulDB at https://vuldb.com/vuln/377789 for any future vendor patch release.