CVE-2026-33616: MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint
An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33616?
CVE-2026-33616 is classified as a high severity vulnerability due to its potential for unauthenticated remote exploitation.
How do I fix CVE-2026-33616?
To fix CVE-2026-33616, update the mbCONNECT24 software to version 2.19.5 or later to mitigate the SQL injection risk.
What type of vulnerability is CVE-2026-33616?
CVE-2026-33616 is an unauthenticated SQL injection vulnerability that allows attackers to manipulate SQL queries.
Who is affected by CVE-2026-33616?
CVE-2026-33616 affects all versions of MB connect line mbCONNECT24 up to and including version 2.19.4.
What is the impact of exploiting CVE-2026-33616?
Exploiting CVE-2026-33616 can lead to unauthorized access to database contents and potential data leakage.