CVE-2026-71237

Name of the Vulnerable Software and Affected Versions Miantang/IoT-PHP (affected versions not specified)

Description The index.php file implements a POST '/userlogin' endpoint that is susceptible to SQL injection. The application reads the password from the pwd variable without sanitization and concatenates it into a raw SQL query. While the username is processed via htmlspecialchars(), this function does not encode single quotes by default, failing to prevent injection. An unauthenticated attacker can use a payload in the pwd variable to bypass authentication or employ UNION-based injection to extract arbitrary data from the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the pwd parameter in the '/userlogin' endpoint until the issue is resolved.