CVE-2021-22848: HGiga MailSherlock - SQL Injection-2

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-18 · updated 2026-06-17
Weakness: CWE-89

Description

HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege.

Affected products

HGiga Msr45 Isherlock-Antispam: before 4.5-133 — fixed in 4.5-133
HGiga Msr45 Isherlock-User: before 4.5-120 — fixed in 4.5-120
HGiga Ssr45 Isherlock-Antispam: before 4.5-133 — fixed in 4.5-133
HGiga Ssr45 Isherlock-User: before 4.5-120 — fixed in 4.5-120

How to fix

Upgrade to a fixed version: HGiga Msr45 Isherlock-Antispam 4.5-133; HGiga Msr45 Isherlock-User 4.5-120; HGiga Ssr45 Isherlock-Antispam 4.5-133; HGiga Ssr45 Isherlock-User 4.5-120. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22848 or the next vulnerability affects your stack