Unscored severity · published Dec 5, 2006
CVE-2006-6142
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Squirrelmail · Squirrelmail
1.4; 1.4.1; 1.4.2; 1.4.3; 1.4.3_r3; 1.4.3_rc1; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-6142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-6142
docs.info.apple.com
http://docs.info.apple.com/article.html?artnum=306172
fedoranews.org
http://fedoranews.org/cms/node/2438
fedoranews.org
http://fedoranews.org/cms/node/2439
lists.apple.com
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
secunia.com
http://secunia.com/advisories/23195
More from Squirrelmail
9.8
CVE-2020-14932
compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request
8.8
CVE-2020-14933
compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request
8.8
CVE-2018-8741
A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the…
8.8
CVE-2017-7692
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call
6.5
CVE-2010-1637
The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal…