CVE-2026-40820

Authenticated SQLi in getVpnData function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 4 more

CVE-2026-40813

Unauthenticated SQLi in getLiveValues

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-40824

Authenticated SQLi in accountstatus view

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-40826

Authenticated SQLi in dsgvo_contracts view

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-40811

Unauthenticated SQLi in ssoabstractservice

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the ssoabstractservice due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-40812

Unauthenticated SQLi in getLiveValues function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions sn parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-40817

Unauthenticated SQLi in getAlarmProfiles function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-40821

Authenticated SQLi in getAccountByID function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-33613

MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray

Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Mbconnectline

Products

Mbconnect24 Mymbconnect24

CVE-2026-33614

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mbconnectline

Products

Mbconnect24 Mymbconnect24

CVE-2026-33615

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mbconnectline

Products

Mbconnect24 Mymbconnect24

CVE-2026-33616

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint

An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mbconnectline

Products

Mbconnect24 Mymbconnect24

CVE-2026-33617

MB connect line mbCONNECT24 vulnerable to an unauthenticated information disclosure in the data24 Endpoint

An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mbconnectline

Products

Mbconnect24 Mymbconnect24

CVE-2025-41688

High Privilege RCE via LUA Sandbox Escape

A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mbconnectline

Products

Rex 200 Rex 300 Mbnet Hw1 and 1 more

CVE-2026-32968

Unauthenticated RCE in com_mb24sysapi

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Mb Connect Line Mbconnect24 and 1 more

CVE-2026-32969

Pre-Auth Blind SQLi in userinfo Endpoint

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Mbconnect24 and 1 more

CVE-2025-41673

Remote Command Injection in send_sms Action Due to Improper Input Neutralization

A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Rex 100 Mbnet.mini Mbnet.mini and 1 more

CVE-2025-41674

Remote Command Injection in diagnostic Action Due to Improper Input Neutralization

A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Mbconnectline

Products

Mbnet.mini Mbnet.mini Firmware

CVE-2025-41675

Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization

A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Rex 100 Mbnet.mini Mbnet.mini and 1 more

CVE-2025-41676

Resource Exhaustion via POST Requests to send-sms Action

A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Rex 100 Mbnet.mini Mbnet.mini and 1 more