rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-40816 Unauthenticated SQLi in _mb24confi_getTagAlarm function
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24alarm.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-05-27T07:48:16.758Z
CVE-2026-40817 Unauthenticated SQLi in getAlarmProfiles function
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-05-27T07:48:32.803Z
CVE-2026-40818 Unauthenticated SQLi in _mb24confi_getDevice function function
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24confi_getDevice function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-05-27T07:48:53.572Z
CVE-2026-40819 Unauthenticated SQLi in sync_data24 task
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the sync_data24 task due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-05-27T07:49:14.497Z
CVE-2026-40821 Authenticated SQLi in getAccountByID function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-05-27T07:49:51.619Z
CVE-2026-40822 Authenticated SQLi in DevSerialReset function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-05-27T07:50:23.128Z
CVE-2026-40823 Authenticated SQLi in DevSerialReset function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2026-05-27T07:50:41.100Z
CVE-2026-40824 Authenticated SQLi in accountstatus view
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2026-05-27T07:50:56.041Z
CVE-2026-40825 Authenticated SQLi in accountstatus view
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2026-05-27T07:52:21.665Z
CVE-2026-40826 Authenticated SQLi in dsgvo_contracts view
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-05-27T07:52:45.810Z
CVE-2026-40827 Authenticated SQLi in _RemoveRequest function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2026-05-27T07:53:12.337Z
CVE-2026-40828 Authenticated SQLi in DeleteSysLogEntry function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2026-05-27T07:53:34.558Z
CVE-2026-40829 Authenticated SQLi in UpdateParam function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2026-05-27T07:53:55.370Z
CVE-2026-40830 Authenticated SQLi in UpdateParam function
A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2026-05-27T07:54:13.439Z
CVE-2026-40831 Authenticated SQLi in Easy View
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-05-27T07:54:35.826Z
CVE-2026-40832 Authenticated SQLi in getDevicegroups function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-05-27T07:54:53.931Z
CVE-2026-40833 Authenticated SQLi in saveDashboardLayout function
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mbCONNECT24
default_status: unaffected
vendor: MB connect line
product: mymbCONNECT24
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
vendor: Helmholz
product: myREX24V2
default_status: unaffected
vendor: Helmholz
product: myREX24V2.virtual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2026-05-27T07:55:27.834Z