IoT-PHP vulnerabilities

1 known vulnerability in IoT-PHP from Miantang. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  IoT-PHP: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-71237Aug 5, 2026Miantang

  Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An u