CVE-2026-60043

Name of the Vulnerable Software and Affected Versions mbCONNECT24 (affected versions not specified)

Description An unauthenticated remote attacker can perform a Cross-site scripting (XSS) attack—a technique where malicious scripts are injected into trusted websites—targeting a logged-in backend user. This allows the attacker to execute multiple critical system actions, such as shutting down the server or restoring an uploaded backup, leading to a loss of integrity and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.