CVE-2026-22315
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Vulnerability in the Meona client and server components (Mesalvo) allows export of user data, including cleartext passwords, via the SQL editor. Affects client versions up to 19.06.2020 15:11:49 and server versions up to 2025.04 5+323020.
Risk Assessment
An attacker with access to the SQL editor can steal sensitive user data, including passwords, leading to confidentiality breaches and further attacks.
Recommendation
Upgrade Meona components to versions newer than those specified in the vulnerability description.
Other vulnerabilities in Meona
See all- CVE-2026-22314Critical
A code injection vulnerability in Meona Client Launcher and Server components allows code execution on other users' systems. Affects versions up to 19.06.2020 15:11:49 (Client Launcher) and up to 2025.04 5+323020 (Server).
- CVE-2026-25602Medium
Insufficient data authenticity verification in Meona Client Launcher and Meona Server components allows sending messages to any email address.
- CVE-2026-0857Medium
Cleartext storage of sensitive information in memory vulnerability in Meona Client Launcher and Meona Server components. Affects Client Launcher through 19.06.2020 15:11:49 and Server through 2025.04 5+323020.
- CVE-2026-0856High
Improper access control in Meona Client Launcher and Meona Server components allows a normal user to gain access to the admin panel. Affects versions up to 19.06.2020 (Client Launcher) and up to 2025.04 5+323020 (Server).
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables the export of user data, including cleartext passwords, via the SQL editor. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.