{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aprogressiverobothmailserver6.2.18/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progressiverobot:hmailserver:6.0.0-b1:*:*:*:*:*:*:*","cpe:2.3:a:progressiverobot:hmailserver:6.2.18:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-126617"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["hMailServer (6.0.0-B1 through 6.2.18)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progressive Robot"],"content_html":"\u003cp\u003eProgressive Robot hMailServer 6.0.0-B1 through 6.2.18 contains a SQL injection vulnerability in the \u003ccode\u003eSQLStatement::GenerateFromCommand\u003c/code\u003e function. The application performs improper parameter binding by performing string replacements on SQL statements rather than using bound parameters. When configured to use MySQL, MariaDB, or PostgreSQL, an attacker can provide input containing parameter names that, when processed, escape the intended SQL literal and inject arbitrary SQL commands. The injected code executes with the privileges of the database service account. SQL Server and SQL Server Compact are not affected as they correctly utilize bound parameters.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized execution of SQL commands with the privileges of the mail server database account. On PostgreSQL, the vulnerability supports command stacking, enabling subsequent arbitrary SQL statements. On MySQL and MariaDB, exploitation is limited to the scope of the original statement.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade hMailServer to a version beyond 6.2.18 immediately once a security update is released by Progressive Robot.\u003c/li\u003e\n\u003cli\u003eAudit database user privileges to follow the principle of least privilege, ensuring the database account used by hMailServer has the minimum necessary access to perform its functions.\u003c/li\u003e\n\u003cli\u003eIf the environment permits, transition to SQL Server or SQL Server Compact to utilize bound parameters, as these configurations are not susceptible to this specific flaw.\u003c/li\u003e\n\u003cli\u003eReview mail server logs for anomalous recipient addresses or metadata patterns that indicate injection attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T14:04:09Z","date_published":"2026-11-11T14:04:09Z","id":"https://feed.craftedsignal.io/briefs/2026-11-01-cve-2026-126617/","summary":"An SQL injection vulnerability in the database layer of Progressive Robot hMailServer versions 6.0.0-B1 through 6.2.18 allows remote attackers to alter SQL statements when using MySQL, MariaDB, or PostgreSQL.","title":"Progressive Robot hMailServer: SQL injection in database layer (CVE-2026-126617)","url":"https://feed.craftedsignal.io/briefs/2026-11-01-cve-2026-126617/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:progressiverobot:hmailserver:6.2.18:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}