CVE-2026-15482 describes a SQL injection vulnerability in Aster Telecom Azcall versions 10 and 11. The issue arises from improper handling of input parameters (nome, perfil, status) in the HTTP Handler component at the endpoint /azcall/adm/gestao_loja/sis.php?t=consultar. This allows an unauthenticated remote attacker to inject SQL commands, potentially compromising the backend database. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). The vendor was contacted but did not provide any response or patch. No official remediation or mitigation details are available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The vulnerability affects the confidentiality, integrity, and availability of the affected system to a limited extent as indicated by the CVSS vector (low to low impact on confidentiality, integrity, and availability).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing application-level input validation or web application firewall (WAF) rules to block malicious input targeting the nome, perfil, and status parameters. Monitor for any updates from the vendor regarding patches or official mitigations.