CVE-2026-71231 IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

CVE-2026-71231

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

CVE-2026-71231

Summary of CVE-2026-71231 (IOTSmartHome) : The checkCookie() function in gui/login.php builds an authentication query by concatenating a decoded lastLogin cookie (base64-decoded with safe_decode()) into SQL: SELECT * FROM users WHERE ID=''. Lack of sanitization before SQL string construction enab...

EUVD-2026-53304

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

CVE-2025-40632

Cross-site scripting XSS in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered...