CVE-2026-15482

Name of the Vulnerable Software and Affected Versions Aster Telecom Azcall versions 10 through 11

Description An issue exists in the HTTP Handler component due to improper processing of the /azcall/adm/gestao loja/sis.php?t=consultar endpoint. A remote attacker can perform a SQL injection by manipulating the nome, perfil, or status arguments. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations As a temporary workaround, restrict access to the /azcall/adm/gestao loja/sis.php?t=consultar endpoint or avoid using the nome, perfil, and status arguments until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.