CVE-2026-6349

HGiga｜iSherlock - OS Command Injection

The  iSherlock developed by HGiga  has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute them on the server.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed

Vendors

Hgiga

Products

Isherlock-audit Isherlock-base

CVE-2025-11900

HGiga｜iSherlock - OS Command Injection

The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2025-3361

HGiga iSherlock - OS Command Injection

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2025-3362

HGiga iSherlock - OS Command Injection

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2025-3363

HGiga iSherlock - OS Command Injection

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2025-7451

Hgiga｜iSherlock - OS Command Injection

The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability has already been exploited. Please update immediately.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2024-4296

HGiga iSherlock - Arbitrary File Download

The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2024-4297

HGiga iSherlock - Arbitrary File Download

The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2024-4298

HGiga iSherlock - Command Injection

The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.

CVSS 3.1 · 7.2 High EPSS 2.1% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2024-4299

HGiga iSherlock - Command Injection

The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.

CVSS 3.1 · 7.2 High EPSS 2.1% KEV · Not listed

Vendors

Hgiga

Products

Isherlock

CVE-2023-37292

HGiga iSherlock - Command Injection

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga iSherlock 5.5 (iSherlock-user modules) allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock 5.5: before iSherlock-user-5.5-174.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Hgiga

Products

Isherlock