Vulnerability · Published Apr 2, 2026 · Assigned by CERTVDE
CVE-2026-33616MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint
High 7.5
In plain English
A high-severity SQL injection in mbCONNECT24 from MB connect line. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 71.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MB connect line | mbCONNECT24 | 0.0.0 – through 2.19.4 |
| MB connect line | mymbCONNECT24 | 0.0.0 – through 2.19.4 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N