https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:40:55 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-71231 <p>IOTSmartHome&#39;s gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID=&#39;&lt;decoded lastLogin cookie&gt;&#39; after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.</p> <p>IOTSmartHome&#39;s gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID=&#39;&lt;decoded lastLogin cookie&gt;&#39; after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-71231 https://vulnerability.circl.lu/vuln/ghsa-hchq-288f-9hjc <p>IOTSmartHome&#39;s gui/login.php checkCookie() function builds an authentication query as SELECT * FROM users WHERE ID=&#39;&lt;decoded lastLogin cookie&gt;&#39; after base64-decoding the client-supplied lastLogin cookie via safe_decode(), which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. An unauthenticated attacker can set a lastLogin cookie containing a base64-encoded SQL injection payload (e.g. base64(&#34;&#39; OR &#39;1&#39;=&#39;1&#34;)) to bypass authentication and, via UNION-based injection, extract arbitrary data including user credentials.</p> <p>IOTSmartHome&#39;s gui/login.php checkCookie() function builds an authentication query as SELECT * FROM users WHERE ID=&#39;&lt;decoded lastLogin cookie&gt;&#39; after base64-decoding the client-supplied lastLogin cookie via safe_decode(), which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. An unauthenticated attacker can set a lastLogin cookie containing a base64-encoded SQL injection payload (e.g. base64(&#34;&#39; OR &#39;1&#39;=&#39;1&#34;)) to bypass authentication and, via UNION-based injection, extract arbitrary data including user credentials.</p> https://vulnerability.circl.lu/vuln/ghsa-hchq-288f-9hjc