EUVD-2026-123335

SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSQL, allows a remote attacker to alter SQL statements the server runs. On those two engines parameters are not bound: SQLStatement::GenerateFromCommand wrote...

CVE-2026-126617

Progressive Robot hMailServer versions 6.0.0-B1 through 6.2.18 are vulnerable to an SQL injection in the database layer when using MySQL/MariaDB or PostgreSQL . The root cause is that SQLStatement::GenerateFromCommand fails to bind parameters, instead performing string replacements that can be ma...