CVE-2024-34472

5.5 mediumEPSS 0.7%

Medium (5.5) in hsclabs mailinspector. EPSS 0.7% chance of exploitation in the next 30 days.

An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerability exists in the mliRealtimeEmails.php file. The ordemGrid parameter in a POST request to /mailinspector/mliRealtimeEmails.php does not properly sanitize input, allowing an authenticated attacker to execute arbitrary SQL commands, leading to the potential disclosure of the entire application database.

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2024-05-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hsclabs:mailinspector

References

https://github.com/osvaldotenorio/CVE-2024-34472
https://github.com/osvaldotenorio/CVE-2024-34472

Check your stack JSON