← Vulnerability feed

Vulnerability record · CVE-2019-1010246 · published 18 July 2019

CVE-2019-1010246: Mailcleaner missing authorization vulnerability

Mailcleaner · Mailcleaner

MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.

7.5 CVSS 3.0 High EPSS 1.4% · top 28.2% CWE-862 · Missing authorization
7.5CVSS 3.0 base score, v2 5.0
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/MailCleaner/MailCleaner/commit/c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 PatchThird Party Advisory
https://github.com/MailCleaner/MailCleaner/commit/c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 PatchThird Party Advisory

Track CVE-2019-1010246 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-3191Mailcleaner os command injection vulnerabilityA vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the …EPSS 5.2%9.6CVE-2024-3192Mailcleaner cross-site scripting vulnerabilityA vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Adm…EPSS 1.00%8.8CVE-2024-3193Mailcleaner os command injection vulnerabilityA vulnerability has been found in MailCleaner up to 2023.03.14 and classified as critical. Affected by this vulnerability is an unknown functionality…EPSS 4.2%8.8CVE-2018-20323MailCleaner Community Edition Logs.php OS command injectionMailCleaner Community Edition 2018.08 contains an OS command injection flaw in www/soap/application/MCSoap/Logs.php. A remote attacker can inject com…EPSS 54%analysed7.2CVE-2024-3195Mailcleaner path traversal vulnerabilityA vulnerability was found in MailCleaner up to 2023.03.14. It has been classified as critical. This affects an unknown part of the component Admin En…EPSS 0.95%6.7CVE-2024-3196Mailcleaner os command injection vulnerabilityA vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Service…EPSS 1.7%6.1CVE-2024-3194Mailcleaner cross-site scripting vulnerabilityA vulnerability was found in MailCleaner up to 2023.03.14 and classified as problematic. Affected by this issue is some unknown functionality of the …EPSS 0.74%6.1CVE-2018-18635Mailcleaner cross-site scripting vulnerabilitywww/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via …EPSS 0.95%

Source: NIST National Vulnerability Database (record CVE-2019-1010246), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.