EUVD-2026-22955
GHSA-3w73-fhv4-qr7q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to perform an SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP(S) request to the web-based management interface of an affected device. A successful exploit could allow the attacker to view data on the affected device.
AnalysisAI
Authenticated SQL injection in Cisco Unity Connection allows attackers with valid user credentials to view arbitrary data from the backend database via the web management interface. The vulnerability requires low privileges and leads to low confidentiality impact, with no integrity or availability compromise. No public exploit or active exploitation has been reported at time of analysis, and EPSS scores indicate low exploitation probability.
More in Cisco Unity Connection
View allRemote code execution in Cisco Unity Connection allows authenticated remote attackers with low-privilege credentials to
Server-Side Request Forgery (SSRF) in Cisco Unity Connection Web Inbox allows remote unauthenticated attackers to send a
Arbitrary file download in Cisco Unity Connection allows authenticated, remote attackers with administrative credentials
File disclosure vulnerability in Cisco Unity Connection's web-based management interface allows authenticated attackers
Cross-site scripting (XSS) in Cisco Unity Connection's web-based management interface enables unauthenticated remote att
We are to synthesize data from multiple sources about CVE-2026-20060 into a comprehensive analysis. Return a JSON object
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today