An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
References
| Link | Resource |
|---|---|
| https://certvde.com/de/advisories/VDE-2026-030 | Third Party Advisory |
| https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-030.json | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
16 Apr 2026, 15:41
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mbconnectline mbconnect24
Mbconnectline Mbconnectline mymbconnect24 |
|
| CPE | cpe:2.3:a:mbconnectline:mymbconnect24:*:*:*:*:*:*:*:* cpe:2.3:a:mbconnectline:mbconnect24:*:*:*:*:*:*:*:* |
|
| References | () https://certvde.com/de/advisories/VDE-2026-030 - Third Party Advisory | |
| References | () https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-030.json - Vendor Advisory |
02 Apr 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-02 10:16
Updated : 2026-04-16 15:41
NVD link : CVE-2026-33616
Mitre link : CVE-2026-33616
CVE.ORG link : CVE-2026-33616
JSON object : View
Products Affected
mbconnectline
- mbconnect24
- mymbconnect24
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')