Skip to content
OpenAdvisories

Product · Miantang

IoT-PHP

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-71237

    Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin

    Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An …

    Miantang IoT-PHP