Vulnerability · Published May 27, 2026 · Assigned by CERTVDE
CVE-2026-40836Authenticated SQLi in inmessage model
High 7.1
In plain English
A high-severity SQL injection in myREX24V2 from Helmholz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 87.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MB connect line | mbCONNECT24 | 0.0.0 – through 2.20.0 |
| MB connect line | mymbCONNECT24 | 0.0.0 – through 2.20.0 |
| MB connect line | mbCONNECT24 | 2.20.0 |
| MB connect line | mymbCONNECT24 | 2.20.0 |
| Helmholz | myREX24V2 | 0.0.0 – through 2.20.0 |
| Helmholz | myREX24V2.virtual | 0.0.0 – through 2.20.0 |
| Helmholz | myREX24V2 | 2.20.0 |
| Helmholz | myREX24V2.virtual | 2.20.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N