CVE-2012-10046: Esva-Project E-Mail Security Virtual Appliance

Critical severity, CVSS 9.3. EPSS: 4.2% chance of exploitation in the next 30 days.

The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection vulnerability in the learn-msg.cgi script. The CGI handler fails to sanitize user-supplied input passed via the id parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and results in full command execution on the underlying system.

Affected products

• Esva-Project E-Mail Security Virtual Appliance

Published 2025-08-08. Last modified 2026-06-16.