Hgiga
41 CVEs across 52 Hgiga products. Browse Hgiga vulnerabilities, severities, and proof-of-concept exploits.
Hgiga products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6349 | Critical | 9.8 | 2026-04-16 | The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and exec… |
CVE-2026-2236 | High | 7.5 | 2026-02-09 | C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database cont… |
CVE-2026-2235 | Medium | 6.5 | 2026-02-09 | C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2026-2234 | Critical | 9.1 | 2026-02-09 | C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read and modify any user's mail content. |
CVE-2025-11900 | Critical | 9.8 | 2025-10-17 | The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execu… |
CVE-2025-7451 | Critical | 9.8 | 2025-07-14 | The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execu… |
CVE-2025-3364 | Medium | 6.7 | 2025-04-08 | The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access… |
CVE-2025-3363 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-3362 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-3361 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-2150 | Medium | 5.4 | 2025-03-10 | The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malic… |
CVE-2024-9924 | Critical | 9.8 | 2024-10-14 | The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can dow… |
CVE-2024-4299 | High | 7.2 | 2024-04-29 | The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain functi… |
CVE-2024-4298 | High | 7.2 | 2024-04-29 | The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function param… |
CVE-2024-4297 | Medium | 4.9 | 2024-04-29 | The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain funct… |
CVE-2024-4296 | Medium | 4.9 | 2024-04-29 | The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain functio… |
CVE-2024-26261 | Critical | 9.8 | 2024-02-15 | The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in… |
CVE-2024-26260 | Critical | 9.8 | 2024-02-15 | The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system… |
CVE-2023-37292 | Critical | 9.8 | 2023-07-21 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga… |
CVE-2023-25909 | Critical | 9.8 | 2023-03-27 | HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability… |
CVE-2023-24842 | Medium | 5.3 | 2023-03-27 | HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access partial content of… |
CVE-2023-24841 | High | 7.2 | 2023-03-27 | HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with admini… |
CVE-2023-24840 | High | 7.2 | 2023-03-27 | HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with administrator privile… |
CVE-2023-24839 | Medium | 6.1 | 2023-03-27 | HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulnerability to inject J… |
CVE-2023-24838 | Critical | 9.8 | 2023-03-27 | HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain the administrator's… |
CVE-2023-24837 | High | 8.8 | 2023-03-27 | HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can explo… |
CVE-2022-38118 | High | 8.8 | 2022-08-30 | OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform SQL-injection to a… |
CVE-2021-37913 | Critical | 9.8 | 2021-09-15 | The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers… |
CVE-2021-37912 | Critical | 9.8 | 2021-09-15 | The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attacke… |
CVE-2021-22848 | High | 7.0 | 2021-03-18 | HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privileg… |
CVE-2021-22852 | High | 8.8 | 2021-01-19 | HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database… |
CVE-2021-22851 | Critical | 9.8 | 2021-01-19 | HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain data… |
CVE-2021-22850 | Medium | 5.3 | 2021-01-19 | HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions. |
CVE-2020-35851 | High | 8.1 | 2020-12-31 | HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute ar… |
CVE-2020-35743 | High | 7.0 | 2020-12-31 | HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages. |
CVE-2020-35742 | High | 7.0 | 2020-12-31 | HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter. |
CVE-2020-35741 | High | 7.0 | 2020-12-31 | HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks. |
CVE-2020-35740 | High | 7.0 | 2020-12-31 | HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks. |
CVE-2020-25850 | High | 8.1 | 2020-12-31 | The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary syste… |
CVE-2020-25848 | Critical | 9.8 | 2020-12-31 | HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism. |
CVE-2020-10512 | High | 8.8 | 2020-04-15 | HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allo… |
CVE-2020-10511 | Critical | 9.8 | 2020-04-15 | HGiga C&Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit t… |
CVE-2019-9883 | High | 8.8 | 2019-06-03 | Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cg… |
CVE-2019-9882 | High | 8.8 | 2019-06-03 | Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list… |
CVE-2018-17542 | Medium | 4.3 | 2019-02-11 | SQL Injection exists in MailSherlock before 1.5.235 for OAKlouds allows an unauthenticated user to extract the subjects of the emails of other users within the… |