CVE-2026-93467

HGiga｜OAKlouds - Insecure Deserialization

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

Oaklouds-custom Page-2.0 Oaklouds-custom Page-3.0 Oaklouds-custom Page-4.0

CVE-2026-93468

HGiga｜OAKlouds - Arbitrary File Read

The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

Oaklouds-bulletin V3-2.0 Oaklouds-bulletin V3-3.0

CVE-2026-6349

HGiga｜iSherlock - OS Command Injection

The  iSherlock developed by HGiga  has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute them on the server.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed

Vendors

Hgiga

Products

Isherlock-audit Isherlock-base

CVE-2026-2236

HGiga｜C&Cm@il - SQL Injection

C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

C&cm@il Package Olln-base

CVE-2026-2234

HGiga｜C&Cm@il - Missing Authentication

C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read and modify any user's mail content.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

C&cm@il Package Olln-base

CVE-2026-2235

HGiga｜C&Cm@il - SQL Injection

C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

C&cm@il Package Olln-base

CVE-2025-7451

Hgiga｜iSherlock - OS Command Injection

The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability has already been exploited. Please update immediately.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2025-11900

HGiga｜iSherlock - OS Command Injection

The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2025-3363

HGiga iSherlock - OS Command Injection

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2025-3364

HGiga PowerStation - Chroot Escape

The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access the entire file system.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

Powerstation

CVE-2025-3362

HGiga iSherlock - OS Command Injection

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2025-3361

HGiga iSherlock - OS Command Injection

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2024-9924

Hgiga OAKlouds - Arbitrary File Read And Delete

The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can download arbitrary system files, which may be deleted subsequently .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

Oaklouds

CVE-2024-4296

HGiga iSherlock - Arbitrary File Download

The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2024-4297

HGiga iSherlock - Arbitrary File Download

The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2024-4298

HGiga iSherlock - Command Injection

The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.

CVSS 3.1 · 7.2 High EPSS 2.1% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2024-4299

HGiga iSherlock - Command Injection

The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.

CVSS 3.1 · 7.2 High EPSS 2.1% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2025-2150

HGiga C&Cm@il - Stored Cross-Site Scripting

The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malicious JavaScript code, which will be executed in the recipient's browser when they view the email.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

C\&cm\@il

CVE-2023-24837

HGiga PowerStation - Command Injection

HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

Powerstation Powerstation Firmware

CVE-2023-24838

HGiga PowerStation - Information Leakage

HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain the administrator's credential. This credential can then be used to login PowerStation or Secure Shell to achieve remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Hgiga

Products

Powerstation Powerstation Firmware