HGiga vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-93468 The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability.High 8.7 · Sep 17, 2026
• CVE-2026-93467 The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability.Critical 9.3 · Sep 17, 2026
• CVE-2026-6349 The  iSherlock developed by HGiga  has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execuCritical 9.3 · Apr 15, 2026
• CVE-2026-2236 C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database conteHigh 8.7 · Feb 9, 2026
• CVE-2026-2235 C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contentsHigh 7.1 · Feb 9, 2026
• CVE-2026-2234 C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read and modify any user's mail content.Critical 9.3 · Feb 9, 2026
• CVE-2025-11900 The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and executCritical 9.3 · Oct 17, 2025
• CVE-2025-7451 The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and executCritical 9.3 · Jul 13, 2025
• CVE-2025-3363 The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands andCritical 9.8 · Apr 7, 2025
• CVE-2025-3362 The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands andCritical 9.8 · Apr 7, 2025
• CVE-2025-3361 The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands andCritical 9.8 · Apr 7, 2025
• CVE-2024-9924 The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk.Critical 9.8 · Oct 14, 2024
• CVE-2024-4299 The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain functioHigh 7.2 · Apr 29, 2024
• CVE-2024-4298 The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameHigh 7.2 · Apr 28, 2024
• CVE-2024-26261 The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability.Critical 9.8 · Feb 14, 2024
• CVE-2024-26260 The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system Critical 9.8 · Feb 14, 2024
• CVE-2023-37292 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga Critical 9.8 · Jul 21, 2023
• CVE-2023-25909 HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type.Critical 9.8 · Mar 27, 2023
• CVE-2023-24841 HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input.High 7.2 · Mar 27, 2023
• CVE-2023-24840 HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input.High 7.2 · Mar 27, 2023
• CVE-2023-24838 HGiga PowerStation has a vulnerability of Information Leakage.Critical 9.8 · Mar 27, 2023
• CVE-2023-24837 HGiga PowerStation remote management function has insufficient filtering for user input.High 8.8 · Mar 27, 2023
• CVE-2022-38118 OAKlouds Portal website’s Meeting Room has insufficient validation for user input.High 8.8 · Aug 30, 2022
• CVE-2021-37913 The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page.Critical 9.8 · Sep 15, 2021
• CVE-2021-37912 The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page.Critical 9.8 · Sep 15, 2021