CVE-2026-71237

Miantang IoT-PHP is affected by an unauthenticated SQL injection in the index.php POST /userlogin route. The code reads the password from $_POST['pwd'] and directly concatenates it into a SQL query: select * from userlists where username='$username' and password='$password' limit 1, without prope...