VULNERABILITY INTELLIGENCE

CVE-2026-40829

CVSS score7 HIGH

EPSS probability0.29%

CISA KEVNot currently listed

Published2026-05-27

Last modified2026-10-26

Description

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.