Skip to main content

Mail Sqr Expert CVE-2022-40741

CRITICAL
OS Command Injection (CWE-78)
2022-10-31 twcert@cert.org.tw
Command Injection Mail Sqr Expert
9.8
CVSS 3.1 · Vendor: cert
Share

Severity by source

Vendor (cert) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Oct 31, 2022 - 07:15 cve.org
CRITICAL 9.8

DescriptionCVE.org

Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to perform arbitrary system command and disrupt service.

AnalysisAI

Mail SQR Expert’s specific function has insufficient filtering for special characters. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to perform arbitrary system command and disrupt service. Affected products include: Softnext Mail Sqr Expert.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.

More in Mail Sqr Expert

View all
CVE-2023-48380 HIGH
8.0 Dec 15

Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a
CVE-2023-48378 HIGH
7.5 Dec 15

Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. Rated high severity

CVE-2023-48382 MEDIUM
6.5 Dec 15

Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail de
CVE-2023-48381 MEDIUM
6.5 Dec 15

Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a special
CVE-2022-40742 MEDIUM
6.5 Oct 31

Mail SQR Expert system has a Local File Inclusion vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is
CVE-2023-48379 MEDIUM
5.3 Dec 15

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter withi

Same weakness CWE-78 – OS Command Injection

View all
CVE-2014-6271 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6
CVE-2014-7169 CRITICAL POC
9.8
CVE-2017-6884 HIGH POC
8.8
CVE-2017-6077 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Share

CVE-2022-40741 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy