Myrex24V2

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T08:00:01.201Z
Updated: 2026-05-27T11:54:47.362Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:59:44.789Z
Updated: 2026-05-27T11:55:01.629Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:59:29.242Z
Updated: 2026-05-27T11:55:15.389Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:59:14.019Z
Updated: 2026-05-27T11:55:30.441Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:58:59.970Z
Updated: 2026-05-27T11:55:44.364Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:58:44.537Z
Updated: 2026-05-27T11:55:57.887Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:58:25.864Z
Updated: 2026-05-27T11:56:11.299Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:58:05.399Z
Updated: 2026-05-27T11:56:24.845Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:57:52.556Z
Updated: 2026-05-27T11:56:38.229Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:57:38.881Z
Updated: 2026-05-27T11:56:52.262Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:57:21.811Z
Updated: 2026-05-27T11:57:07.786Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:57:07.966Z
Updated: 2026-05-27T11:57:21.263Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:56:51.479Z
Updated: 2026-05-27T11:57:35.412Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:56:35.787Z
Updated: 2026-05-27T11:57:49.553Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Published: 2026-05-27T07:56:21.298Z
Updated: 2026-05-27T11:58:03.081Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:56:00.875Z
Updated: 2026-05-27T11:58:17.099Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Published: 2026-05-27T07:55:44.947Z
Updated: 2026-05-27T11:58:31.072Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Published: 2026-05-27T07:55:27.834Z
Updated: 2026-05-27T11:58:44.521Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:54:53.931Z
Updated: 2026-05-27T11:58:58.588Z

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:54:35.826Z
Updated: 2026-05-27T11:59:12.569Z

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Published: 2026-05-27T07:54:13.439Z
Updated: 2026-05-27T11:59:26.164Z

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Published: 2026-05-27T07:53:55.370Z
Updated: 2026-05-27T11:59:40.342Z

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Published: 2026-05-27T07:53:34.558Z
Updated: 2026-05-27T11:59:53.882Z

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Published: 2026-05-27T07:53:12.337Z
Updated: 2026-05-27T12:00:10.336Z

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:52:45.810Z
Updated: 2026-05-27T12:00:23.838Z

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Published: 2026-05-27T07:52:21.665Z
Updated: 2026-05-27T12:00:37.390Z

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Published: 2026-05-27T07:50:56.041Z
Updated: 2026-05-27T12:00:51.291Z

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Published: 2026-05-27T07:50:41.100Z
Updated: 2026-05-27T12:01:06.517Z

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:50:23.128Z
Updated: 2026-05-27T12:01:20.461Z

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:49:51.619Z
Updated: 2026-05-27T12:01:33.936Z

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the sync_data24 task due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:49:14.497Z
Updated: 2026-05-27T12:01:47.280Z

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24confi_getDevice function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:48:53.572Z
Updated: 2026-05-27T12:02:00.721Z

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:48:32.803Z
Updated: 2026-05-27T12:02:14.206Z

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24alarm.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:48:16.758Z
Updated: 2026-05-27T12:02:27.818Z

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24api_getUserAccount function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:47:36.405Z
Updated: 2026-05-27T12:02:41.770Z

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dataapi.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:47:05.528Z
Updated: 2026-05-27T12:02:55.853Z

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:45:29.214Z
Updated: 2026-05-27T12:03:09.938Z

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions sn parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:45:09.015Z
Updated: 2026-05-27T12:03:23.991Z

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the ssoabstractservice due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:44:32.633Z
Updated: 2026-05-27T12:03:38.795Z

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-05-27T07:38:42.445Z
Updated: 2026-05-27T12:03:54.226Z

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Published: 2026-03-23T11:16:22.255Z
Updated: 2026-03-23T16:01:30.953Z

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383.

Published: 2026-03-23T11:16:01.413Z
Updated: 2026-03-23T13:51:18.931Z