PatchSiren

Miantang CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL Miantang CVE published 2026-08-05

CVE-2026-71237

The CVE-2026-71237 vulnerability is a critical SQL injection issue in the IoT-PHP project, specifically in the index.php file's POST /userlogin route. This route reads the password directly from $_POST['pwd'] without sanitization and concatenates it into a raw SQL string, allowing attackers to bypass authentication and extract arbitrary data via UNION-based injection. The vulnerability has a CVSS score of [truncated]