CVE-2026-33615

CRITICAL 9.1CVE-2026-33615 · Published 02/04/2026 · updated 26/10/2026

Package	Affected versions	Patched versions
mbconnect24 mbconnectline	`≤ 2.19.4`	No fix yet
mymbconnect24 mbconnectline	`≤ 2.19.4`	No fix yet

Description

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.

References

certvde.com/de/advisories/VDE-2026-030 · Third Party Advisory
mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-030.json · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free