CVE-2024-34470

HSC Mailinspector versions 5.2.17-3 through 5.2.18 are vulnerable to an Unauthenticated Path Traversal vulnerability in the /public/loader.php file. The application fails to properly filter the path parameter, allowing an attacker to bypass webroot restrictions and read arbitrary files on the ser...

CVE-2024-32371

HSC Cybersecurity HC Mailinspector (versions 5.2.17-3 through 5.2.18 ) is vulnerable to a privilege escalation flaw due to insufficient access control checks on the type parameter. A regular user can gain administrative access by intercepting or crafting a request to change the type parameter val...

CVE-2024-32370

HSC Cybersecurity HC Mailinspector versions 5.2.17-3 through 5.2.18 are vulnerable to a flaw in the mliSystemUsers.php component. A remote attacker can exploit this by sending a crafted payload to the id parameter to obtain sensitive information . As a temporary workaround, it is recommended to r...

CVE-2024-32369

HSC Cybersecurity HC Mailinspector versions 5.2.17-3 through 5.2.18 are vulnerable to a SQL Injection vulnerability in the mliWhiteList.php component. A remote attacker can exploit the start and limit parameters by sending a crafted payload, such as exec=fetch&start=0&limit=30', to obtain sensiti...

CVE-2024-34471

A Path Traversal vulnerability exists in HSC Mailinspector (versions 5.2.17-3 through 5.2.18) within the mliRealtimeEmails.php file. The filename parameter in the export HTML functionality fails to properly validate file locations, allowing an attacker to read and delete arbitrary files on the se...

CVE-2024-34472

HSC Mailinspector versions 5.2.17-3 through 5.2.18 are vulnerable to an authenticated blind SQL injection in the mliRealtimeEmails.php file. The root cause is the improper sanitization of the ordemGrid parameter during a POST request to /mailinspector/mliRealtimeEmails.php. An authenticated attac...

CVE-2026-29962

HSC MailInspector version 5.3.3-7 is vulnerable to a Local File Inclusion (LFI) flaw caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters without sufficient validation or sanitization. This allows a remote attacker t...

CVE-2026-29963

HSC MailInspector version 5.3.3-7 is vulnerable to a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The application uses the text parameter to construct file paths without adequate normalization or restriction to a safe base directory. ...

CVE-2026-29965

HSC MailInspector version 5.3.3-7 is vulnerable to Cross-Site Scripting (XSS) within the /police/WarningUrlPage.php endpoint. The root cause is the improper neutralization of user-supplied input that utilizes alternate or obfuscated JavaScript syntax. This flaw could allow an attacker to execute ...

CVE-2026-29964

HSC MailInspector version 5.3.3-7 is vulnerable to a Cross-Site Scripting (XSS) flaw in the /tap/tap.php endpoint. The root cause is the improper neutralization of user-controlled input using alternate or obfuscated JavaScript syntax , where unsanitized input is reflected in HTTP responses withou...