TI-2026-49908 CVE-2026-71237 · GHSA-wjx2-3579-9x87
Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin
Priority MEDIUM 50
Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where use…