Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 68

Export CSV
CVE-2026-60041

CSRF in backend

An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Firmware Myrex24v2virtual Mbconnect24 and 1 more
CVE-2026-60042

Authentication bypass in com_check

An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially triggering traffic on other systems and email alerts. This can result in some loss of availability due to higher system loads.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Firmware Myrex24v2virtual Mbconnect24 and 1 more
CVE-2026-60037

OpenSSL command injection in device importer

A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Firmware Myrex24v2virtual Mbconnect24 and 1 more
CVE-2026-60043

XSS in backend

An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Firmware Myrex24v2virtual Mbconnect24 and 1 more
CVE-2026-14448

Authenticated RCE in system_certificates view

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-10521

Authenticated unintended access to critical program parameters

An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mb Connect Line
Products
Mbconnect24 Mymbconnect24
CVE-2026-40813

Unauthenticated SQLi in getLiveValues

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more
CVE-2026-40824

Authenticated SQLi in accountstatus view

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more
CVE-2026-40826

Authenticated SQLi in dsgvo_contracts view

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line Mbconnectline
Products
Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more
CVE-2026-40819

Unauthenticated SQLi in sync_data24 task

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the sync_data24 task due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more
CVE-2026-40843

Authenticated SQLi in alarming view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more