Authenticated SQLi in saveDashboardLayout function
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| MB connect line | mbCONNECT24 | unaffected |
|
||||||
| MB connect line | mymbCONNECT24 | unaffected |
|
||||||
| MB connect line | mbCONNECT24 | unaffected |
|
||||||
| MB connect line | mymbCONNECT24 | unaffected |
|
||||||
| Helmholz | myREX24V2 | unaffected |
|
||||||
| Helmholz | myREX24V2.virtual | unaffected |
|
||||||
| Helmholz | myREX24V2 | unaffected |
|
||||||
| Helmholz | myREX24V2.virtual | unaffected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Helmholz | Myrex24v2 |
|
||||||||||||
| Helmholz | Myrex24v2 |
|
||||||||||||
| Helmholz | Myrex24v2 |
|
||||||||||||
| Helmholz | Myrex24v2.virtual |
|
||||||||||||
| Helmholz | Myrex24v2.virtual |
|
||||||||||||
| Helmholz | Myrex24v2.virtual |
|
||||||||||||
| Mb Connect Line | Mbconnect24 |
|
||||||||||||
| Mb Connect Line | Mbconnect24 |
|
||||||||||||
| Mb Connect Line | Mbconnect24 |
|
||||||||||||
| Mb Connect Line | Mymbconnect24 |
|
||||||||||||
| Mb Connect Line | Mymbconnect24 |
|
||||||||||||
| Mb Connect Line | Mymbconnect24 |
|
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.223% probability within 30 days)
| Link | Providers |
|---|---|
| https://www.certvde.com/en/advisories/VDE-2026-044/ |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity. | |
| Title | Authenticated SQLi in saveDashboardLayout function | |
| First Time appeared |
Helmholz
Helmholz myrex24v2 Helmholz myrex24v2.virtual Helmholz myrex24v2virtual Mb Connect Line Mb Connect Line mbconnect24 Mb Connect Line mymbconnect24 |
|
| Weaknesses | CWE-89 | |
| CPEs | cpe:2.3:a:helmholz:myrex24v2.virtual:*:*:*:*:*:*:*:* cpe:2.3:a:helmholz:myrex24v2:*:*:*:*:*:*:*:* cpe:2.3:a:mb_connect_line:mbconnect24:*:*:*:*:*:*:*:* cpe:2.3:a:mb_connect_line:mymbconnect24:*:*:*:*:*:*:*:* cpe:2.3:o:helmholz:myrex24v2:2.20.0:*:*:*:*:*:*:* cpe:2.3:o:helmholz:myrex24v2virtual:2.20.0:*:*:*:*:*:*:* cpe:2.3:o:mb_connect_line:mbconnect24:2.20.0:*:*:*:*:*:*:* cpe:2.3:o:mb_connect_line:mymbconnect24:2.20.0:*:*:*:*:*:*:* |
|
| Vendors & Products |
Helmholz
Helmholz myrex24v2 Helmholz myrex24v2.virtual Helmholz myrex24v2virtual Mb Connect Line Mb Connect Line mbconnect24 Mb Connect Line mymbconnect24 |
|
| References |
| |
| Metrics |
cvssV3_1
|