CVE-2026-19764 is a SQL injection vulnerability in Raisecom Communication Command and Dispatch Management Platform versions up to 7.6.5. The flaw is located in the /app/users/getpwd.php file where the sip argument is improperly sanitized, allowing remote attackers to inject SQL commands. Exploit code is publicly available, but there is no indication of active exploitation in the wild. The vendor was contacted but did not provide any response or patch information.

Successful exploitation of this vulnerability could lead to unauthorized SQL command execution, potentially resulting in data leakage, data manipulation, or denial of service. The CVSS score of 7.3 reflects a moderate impact on confidentiality, integrity, and availability. However, no confirmed active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing application-level mitigations such as input validation or restricting access to the affected endpoint until a patch is released.