Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 81

Export CSV
CVE-2026-40825

Authenticated SQLi in accountstatus view

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40846

Authenticated SQLi in system view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40829

Authenticated SQLi in UpdateParam function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40830

Authenticated SQLi in UpdateParam function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40831

Authenticated SQLi in Easy View

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40833

Authenticated SQLi in saveDashboardLayout function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40835

Authenticated SQLi in saveObjectFromData function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40836

Authenticated SQLi in inmessage model

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40837

Authenticated SQLi in getProjectScalings function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40838

Authenticated SQLi in getDeviceScalings function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40839

Authenticated SQLi in getComponentScalings function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40841

Authenticated SQLi in getProjectTags function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40842

Authenticated SQLi in getWidgetTags function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40847

Authenticated SQLi in system_tag view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40850

Unauthenticated SQLi in getAccountData function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40851

Command injection via USB

A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Rex100 Rex200 250 Mbnet and 2 more
CVE-2025-41688

High Privilege RCE via LUA Sandbox Escape

A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mbconnectline
Products
Rex 200 Rex 300 Mbnet Hw1 and 1 more
CVE-2026-32968

Unauthenticated RCE in com_mb24sysapi

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Mb Connect Line Mbconnect24 and 1 more
CVE-2026-32969

Pre-Auth Blind SQLi in userinfo Endpoint

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Mbconnect24 and 1 more
CVE-2025-41673

Remote Command Injection in send_sms Action Due to Improper Input Neutralization

A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Rex 100 Mbnet.mini Mbnet.mini and 1 more