CVE-2026-33614: fallo de gravedad alta en mbCONNECT24
MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.3%
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVEs relacionadas — mbCONNECT24
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-34580HIGHRemote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0EPSS 1.0%CVE-2020-12527MEDIUMImproper Access Validation in products of MB connect line and HelmholzEPSS 1.0%CVE-2022-22520MEDIUMUser enumeration vulnerability in MB connect line and Helmholz productsEPSS 1.0%CVE-2021-34575HIGHInformation Exposure in mymbCONNECT24, mbCONNECT24 <= 2.8.0EPSS 1.0%CVE-2026-14448HIGHAuthenticated RCE in system_certificates viewEPSS 0.9%CVE-2020-12528MEDIUMCVE-2020-12528EPSS 0.9%