CVE-2024-34470

CVE-2024-34470 affects HSC Mailinspector versions 5.2.17-3 through 5.2.18. It is an unauthenticated Local/File Inclusion in /public/loader.php where the path parameter can traverse outside the webroot due to insufficient validation, enabling read access to arbitrary server files (confidentiality ...

CVE-2024-32371

Summary: CVE-2024-32371 affects HSC Cybersecurity HC Mailinspector (versions 5.2.17-3 through 5.2.18). The issue allows a regular user to escalate privileges to administrative access by changing the type parameter from 1 to 0, indicating a privilege escalation flaw in the affected component. What...

CVE-2024-32369

The CVE-2024-32369 entry documents a SQL Injection vulnerability in HSC Cybersecurity HC Mailinspector, specifically affecting versions 5.2.17-3 through 5.2.18. The vulnerability targets the mliWhiteList.php component, with exploitation via crafted payloads in the start and limit parameters, enab...

CVE-2024-34471

CVE-2024-34471 affects HSC Mailinspector 5.2.17-3 (and up to 5.2.18 per CNVD/CNNVD) due to a faulty validation of the filename parameter in the mliRealtimeEmails.php export HTML function. The path traversal flaw enables an attacker to read and delete arbitrary server files, evidenced by reads of ...

CVE-2024-32370

The issue affects HSC Cybersecurity HC Mailinspector versions 5.2.17-3 through 5.2.18. A remote attacker can obtain sensitive information by sending a crafted payload to the id parameter in the mliSystemUsers.php component, indicating an information disclosure vulnerability stemming from the hand...

CVE-2024-34472

HSC Mailinspector versions 5.2.17-3 through 5.2.18 are affected by an authenticated blind SQL injection in mliRealtimeEmails.php. The ordemGrid parameter in POST requests to /mailinspector/mliRealtimeEmails.php is not properly sanitized, allowing an authenticated attacker to execute arbitrary SQL...

CVE-2026-29963

CVE-2026-29963 affects HSC MailInspector 5.3.3-7. The vulnerability is a Path Traversal in the /tap/dw.php endpoint where the text parameter is used to build file paths without proper normalization or safe base-directory restriction. This improper input validation can allow a remote attacker to a...

CVE-2026-29964

HSC MailInspector v5.3.3-7 is affected by a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint. The issue arises from improper neutralization of user-controlled input, with alternate or obfuscated JavaScript syntax reflected back in HTTP responses without adequate output encodi...

CVE-2026-29962

The CVE-2026-29962 issue affects HSC MailInspector v5.3.3-7 and is an LFI vulnerability caused by improper validation of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes parameters that directly influence file access, enabling path traversal to read arbitrary files fro...

CVE-2026-29965

HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) at the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax. Affected product: HSC MailInspector (version 5.3.3-7). The CVE entry (CVE-202...