← Vulnerability feed

Vulnerability record · CVE-2018-10356 · published 23 May 2018

CVE-2018-10356: Trendmicro email encryption gateway sql injection vulnerability

Trendmicro · Email Encryption Gateway

A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability.

8.8 CVSS 3.0 High EPSS 10% · top 4.5% CWE-89 · SQL injection
8.8CVSS 3.0 base score, v2 9.0
10%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://success.trendmicro.com/solution/1119349 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-18-420/ Third Party AdvisoryVDB Entry
https://success.trendmicro.com/solution/1119349 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-18-420/ Third Party AdvisoryVDB Entry

Track CVE-2018-10356 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-6228Trendmicro email encryption gateway sql injection vulnerabilityA SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to upload a…EPSS 10%9.8CVE-2018-6229Trendmicro email encryption gateway sql injection vulnerabilityA SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commands to up…EPSS 10%9.8CVE-2018-6220Trendmicro email encryption gateway injection vulnerabilityAn arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to…EPSS 9.9%9.8CVE-2018-6223Trendmicro email encryption gateway missing authentication for critical function vulnerabilityA missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to manipulate t…EPSS 10%9.8CVE-2016-4351Trendmicro email encryption gateway sql injection vulnerabilitySQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows remote a…EPSS 2.8%8.8CVE-2018-10351Trendmicro email encryption gateway sql injection vulnerabilityA vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installat…EPSS 3.6%8.8CVE-2018-10352Trendmicro email encryption gateway sql injection vulnerabilityA vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installat…EPSS 2.1%8.8CVE-2018-10354Trendmicro email encryption gateway os command injection vulnerabilityA command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbit…EPSS 13%

Source: NIST National Vulnerability Database (record CVE-2018-10356), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.