Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

Export CSV
CVE-2026-40813

Unauthenticated SQLi in getLiveValues

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more
CVE-2026-40824

Authenticated SQLi in accountstatus view

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more
CVE-2026-40826

Authenticated SQLi in dsgvo_contracts view

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more
CVE-2026-40811

Unauthenticated SQLi in ssoabstractservice

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the ssoabstractservice due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more
CVE-2026-40812

Unauthenticated SQLi in getLiveValues function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions sn parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more
CVE-2026-40817

Unauthenticated SQLi in getAlarmProfiles function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more
CVE-2026-40821

Authenticated SQLi in getAccountByID function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more
CVE-2026-32968

Unauthenticated RCE in com_mb24sysapi

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Mb Connect Line Mbconnect24 and 1 more
CVE-2026-32969

Pre-Auth Blind SQLi in userinfo Endpoint

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Mbconnect24 and 1 more