CVE-2026-19764 is a SQL injection vulnerability in Raisecom Communication Command and Dispatch Management Platform versions up to 7.6.5. The issue arises from improper sanitization of the 'sip' parameter in the /app/users/getpwd.php endpoint, allowing remote attackers to inject SQL commands. The vulnerability can be exploited without privileges or user interaction. Public exploit code exists, but there is no indication of active exploitation in the wild. The vendor was contacted but did not provide a response or patch.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. The vulnerability affects confidentiality, integrity, and availability to a limited extent. Given the medium CVSS score and remote exploitability, this poses a moderate risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying temporary mitigations such as restricting access to the affected endpoint, implementing web application firewalls with SQL injection protections, and monitoring for suspicious activity targeting the 'sip' parameter.