CVE-2019-7214
Critical · 9.8CVSS
9.8
EPSS
84.8%
Published
Apr 24, 2019
CISA due date
—
The record
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection… CWE-502
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-502
- CVE-2026-96745 Deserialization of untrusted data in the command monitoring support of the MongoDB PHP… CWE-502
- CVE-2026-62107 Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions. CWE-502
- CVE-2026-62103 Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions. CWE-502
- CVE-2026-62105 Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions. CWE-502
- CVE-2026-73699 FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows… CWE-502
- CVE-2026-82925 The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being… CWE-502