Log in Start free

Vulnerability · Published May 27, 2026 · Assigned by CERTVDE

CVE-2026-40833Authenticated SQLi in saveDashboardLayout function

High 7.1

In plain English

A high-severity SQL injection in myREX24V2 from Helmholz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 87.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

Affected products (as reported)

VendorProductVersions
MB connect line mbCONNECT24 0.0.0 – through 2.20.0
MB connect line mymbCONNECT24 0.0.0 – through 2.20.0
MB connect line mbCONNECT24 2.20.0
MB connect line mymbCONNECT24 2.20.0
Helmholz myREX24V2 0.0.0 – through 2.20.0
Helmholz myREX24V2.virtual 0.0.0 – through 2.20.0
Helmholz myREX24V2 2.20.0
Helmholz myREX24V2.virtual 2.20.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References