CVE-2026-33616 in mbCONNECT24

Sumário (Inglês)

An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Responsável

CERTVDE

Reservar

23/03/2026

Divulgação

02/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354852	MB connect line mbCONNECT24/mymbCONNECT24 mb24api Injeção SQL	89	Não definido	Não definido	CVE-2026-33616

Fontes

• MITRE
• NVD
• CVE Details