What’s Vulnerable › Products

MB connect line mbCONNECT24 vulnerabilities

85 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 52 published in the last 12 months.

Check whether your MB connect line mbCONNECT24 version is affected

Latest MB connect line mbCONNECT24 vulnerabilities

• CVE-2026-14448 — Authenticated RCE in system_certificates view (CVSS 7.2)
• CVE-2026-10521 — Authenticated unintended access to critical program parameters (CVSS 7.2)
• CVE-2026-40850 — Unauthenticated SQLi in getAccountData function (CVSS 7.5)
• CVE-2026-40849 — Authenticated SQLi in user_alarmprofile view (CVSS 6.5)
• CVE-2026-40848 — Authenticated SQLi in tag view (CVSS 6.5)
• CVE-2026-40847 — Authenticated SQLi in system_tag view (CVSS 6.5)
• CVE-2026-40846 — Authenticated SQLi in system view (CVSS 6.5)
• CVE-2026-40845 — Authenticated SQLi in devices_configuration view (CVSS 6.5)
• CVE-2026-40844 — Authenticated SQLi in dashboard view (CVSS 6.5)
• CVE-2026-40843 — Authenticated SQLi in alarming view (CVSS 6.5)
• CVE-2026-40842 — Authenticated SQLi in getWidgetTags function (CVSS 6.5)
• CVE-2026-40841 — Authenticated SQLi in getProjectTags function (CVSS 6.5)
• CVE-2026-40840 — Authenticated SQLi in VerifyCreateLicences function (CVSS 6.5)
• CVE-2026-40839 — Authenticated SQLi in getComponentScalings function (CVSS 6.5)
• CVE-2026-40838 — Authenticated SQLi in getDeviceScalings function (CVSS 6.5)
• CVE-2026-40837 — Authenticated SQLi in getProjectScalings function (CVSS 6.5)
• CVE-2026-40836 — Authenticated SQLi in inmessage model (CVSS 7.1)
• CVE-2026-40835 — Authenticated SQLi in saveObjectFromData function (CVSS 6.5)
• CVE-2026-40834 — Authenticated SQLi in saveDashboardLayout function (CVSS 7.1)
• CVE-2026-40833 — Authenticated SQLi in saveDashboardLayout function (CVSS 7.1)
• CVE-2026-40832 — Authenticated SQLi in getDevicegroups function (CVSS 6.5)
• CVE-2026-40831 — Authenticated SQLi in Easy View (CVSS 6.5)
• CVE-2026-40830 — Authenticated SQLi in UpdateParam function (CVSS 5.5)
• CVE-2026-40829 — Authenticated SQLi in UpdateParam function (CVSS 5.5)
• CVE-2026-40828 — Authenticated SQLi in DeleteSysLogEntry function (CVSS 5.5)