Threat database

CVE-2026-100741 is a critical eval injection vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.3 on Windows. It allows a remote unauthenticated attacker to execute arbitrary JScript code with service account privileges via crafted passwords or certain message fields when event scripting is enabled with JScript and specific event handlers are defined. The vulnerability does not affect VBScript event scripts or Linux builds. Exploitation requires non-default configurations enabling JScript event scripting and relevant handlers.

Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServer admin consoles with configured connections.

Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file.

An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMailServer.ini components.