Login Request a demo
SQ
Vendor
Squirrelmail
7 products with CVEs on record
76
CVEs
0
On KEV
0
New 30D
Products
SQ
Squirrelmail
Squirrelmail
9.8
64 CVEs0 on KEV0 new
GP
Gpg Plugin
Squirrelmail
–
7 CVEs0 on KEV0 new
AA
Address Add Plugin
Squirrelmail
–
1 CVEs0 on KEV0 new
CP
Change Passwd
Squirrelmail
7.5
1 CVEs0 on KEV0 new
IG
Imap General.php
Squirrelmail
–
1 CVEs0 on KEV0 new
SM
S Mime Plugin
Squirrelmail
–
1 CVEs0 on KEV0 new
VP
Vacation Plugin
Squirrelmail
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2020-14933
SQ
Squirrelmail
Squirrelmail
8.8
1%
Jun 20compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request
CVE-2020-14932
SQ
Squirrelmail
Squirrelmail
9.8
1%
Jun 20compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request
CVE-2012-5623
CP
Change Passwd
Squirrelmail
7.5
1%
Feb 13Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords
CVE-2019-12970
SQ
Squirrelmail
Squirrelmail
6.1
2%
Jul 1XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2
CVE-2018-14952
SQ
Squirrelmail
Squirrelmail
6.1
1%
Aug 5The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack
CVE-2018-14950
SQ
Squirrelmail
Squirrelmail
6.1
1%
Aug 5The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack
CVE-2018-14951
SQ
Squirrelmail
Squirrelmail
6.1
1%
Aug 5The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack
CVE-2018-14955
SQ
Squirrelmail
Squirrelmail
6.1
1%
Aug 5The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute)
CVE-2018-14954
SQ
Squirrelmail
Squirrelmail
6.1
2%
Aug 5The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute
CVE-2018-14953
SQ
Squirrelmail
Squirrelmail
6.1
1%
Aug 5The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack
CVE-2018-8741
SQ
Squirrelmail
Squirrelmail
8.8
4%
Mar 17A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the…
CVE-2017-7692
SQ
Squirrelmail
Squirrelmail
8.8
32%
Apr 20SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call
CVE-2012-2124
SQ
Squirrelmail
Squirrelmail
–
2%
Jan 18functions/imap_general.php in SquirrelMail, as used in Red Hat Enterprise Linux (RHEL) 4 and 5, does not properly handle 8-bit characters in passwords, which allows remote…
CVE-2011-2753
SQ
Squirrelmail
Squirrelmail
–
1%
Jul 17Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via…
CVE-2011-2752
SQ
Squirrelmail
Squirrelmail
–
2%
Jul 17CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a different vulnerability…
CVE-2011-2023
SQ
Squirrelmail
Squirrelmail
–
2%
Jul 14Cross-site scripting (XSS) vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE…
CVE-2010-4555
SQ
Squirrelmail
Squirrelmail
–
2%
Jul 14Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving (1)…
CVE-2010-4554
SQ
Squirrelmail
Squirrelmail
–
2%
Jul 14functions/page_header.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote…
CVE-2010-2813
SQ
Squirrelmail
Squirrelmail
–
4%
Aug 19functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk…
CVE-2010-1637
SQ
Squirrelmail
Squirrelmail
6.5
3%
Jun 22The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal…
CVE-2009-2964
SQ
Squirrelmail
Squirrelmail
–
2%
Aug 25Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of…
CVE-2009-1381
IG
Imap General.php
Squirrelmail
–
3%
May 22The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote…
CVE-2009-1581
SQ
Squirrelmail
Squirrelmail
–
2%
May 14functions/mime.php in SquirrelMail before 1.4.18 does not protect the application's content from Cascading Style Sheets (CSS) positioning in HTML e-mail messages, which allows…
CVE-2009-1580
SQ
Squirrelmail
Squirrelmail
–
2%
May 14Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie
CVE-2009-1579
SQ
Squirrelmail
Squirrelmail
–
3%
May 14The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.18 and NaSMail before 1.7 allows remote attackers to execute arbitrary commands via shell…
CVE-2009-1578
SQ
Squirrelmail
Squirrelmail
–
2%
May 14Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.4.18 and NaSMail before 1.7 allow remote attackers to inject arbitrary web script or HTML via vectors…
CVE-2009-0030
SQ
Squirrelmail
Squirrelmail
–
2%
Jan 21A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists…
CVE-2008-2379
SQ
Squirrelmail
Squirrelmail
–
2%
Dec 5Cross-site scripting (XSS) vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink in an HTML part of an…
CVE-2008-3663
SQ
Squirrelmail
Squirrelmail
–
2%
Sep 24Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote…
CVE-2007-6348
SQ
Squirrelmail
Squirrelmail
–
4%
Dec 14SquirrelMail 1.4.11 and 1.4.12, as distributed on sourceforge.net before 20071213, has been externally modified to create a Trojan Horse that introduces a PHP remote file…
CVE-2007-3778
GP
Gpg Plugin
Squirrelmail
–
3%
Jul 15The G/PGP (GPG) Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the messageSignedText…
CVE-2007-3779
GP
Gpg Plugin
Squirrelmail
–
1%
Jul 15PHP local file inclusion vulnerability in gpg_pop_init.php in the G/PGP (GPG) Plugin before 20070707 for Squirrelmail allows remote attackers to include and execute arbitrary…
CVE-2006-4169
GP
Gpg Plugin
Squirrelmail
–
2%
Jul 15Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2.0, and 2.1dev before 20070614, for Squirrelmail allow remote authenticated users to include and execute…
CVE-2007-3635
SQ
Squirrelmail
Squirrelmail
–
0%
Jul 10Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2.1 for Squirrelmail might allow "local authenticated users" to inject certain commands via unspecified…
CVE-2007-3636
GP
Gpg Plugin
Squirrelmail
–
3%
Jul 10Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin 2.1 for Squirrelmail allow remote attackers to execute arbitrary commands via unspecified vectors
CVE-2007-3634
GP
Gpg Plugin
Squirrelmail
–
2%
Jul 10Unspecified vulnerability in the G/PGP (GPG) Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via unspecified vectors, possibly…
CVE-2007-2631
SQ
Squirrelmail
Squirrelmail
–
1%
May 13Cross-site request forgery (CSRF) vulnerability in SquirrelMail 1.4.8-4.fc6 and earlier allows remote attackers to perform unspecified actions as arbitrary users via unspecified…
CVE-2007-1262
SQ
Squirrelmail
Squirrelmail
–
3%
May 11Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the…
CVE-2007-2589
SQ
Squirrelmail
Squirrelmail
–
1%
May 11Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data…
CVE-2006-6142
SQ
Squirrelmail
Squirrelmail
–
2%
Dec 5Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter…
CVE-2006-4019
SQ
Squirrelmail
Squirrelmail
–
10%
Aug 11Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the…
CVE-2006-3665
SQ
Squirrelmail
Squirrelmail
–
1%
Jul 18SquirrelMail 1.4.6 and earlier, with register_globals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors
CVE-2006-3174
SQ
Squirrelmail
Squirrelmail
–
2%
Jun 23Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary HTML via…
CVE-2006-2842
SQ
Squirrelmail
Squirrelmail
–
47%
Jun 6PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote…
CVE-2006-0195
SQ
Squirrelmail
Squirrelmail
–
2%
Feb 24Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers…
CVE-2006-0377
SQ
Squirrelmail
Squirrelmail
–
2%
Feb 24CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the…
CVE-2006-0188
SQ
Squirrelmail
Squirrelmail
–
2%
Feb 24webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter
CVE-2005-1924
GP
Gpg Plugin
Squirrelmail
–
10%
Dec 31The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the…
CVE-2005-3128
AA
Address Add Plugin
Squirrelmail
–
3%
Oct 4Cross-site scripting (XSS) vulnerability in add.php in Address Add Plugin 1.9 and 2.0 for Squirrelmail allows remote attackers to inject arbitrary web script or HTML via the IMG…
CVE-2005-2095
SQ
Squirrelmail
Squirrelmail
–
4%
Jul 13options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which allows remote attackers to modify or read the preferences…
CVE-2005-1769
SQ
Squirrelmail
Squirrelmail
–
2%
Jun 16Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in…
CVE-2005-0239
SM
S Mime Plugin
Squirrelmail
–
4%
May 2viewcert.php in the S/MIME plugin 0.4 and 0.5 for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the cert parameter
CVE-2005-0183
VP
Vacation Plugin
Squirrelmail
–
0%
May 2ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in a command line argument
CVE-2004-1036
SQ
Squirrelmail
Squirrelmail
–
3%
Mar 1Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October…
CVE-2005-0152
SQ
Squirrelmail
Squirrelmail
–
4%
Feb 2PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via "URL manipulation."
CVE-2005-0075
SQ
Squirrelmail
Squirrelmail
–
2%
Jan 29prefs.php in SquirrelMail before 1.4.4, with register_globals enabled, allows remote attackers to inject local code into the SquirrelMail code via custom preference handlers
CVE-2005-0104
SQ
Squirrelmail
Squirrelmail
–
2%
Jan 29Cross-site scripting (XSS) vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via certain integer variables
CVE-2005-0103
SQ
Squirrelmail
Squirrelmail
–
2%
Jan 24PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by modifying a URL parameter to reference…
CVE-2004-0520
SQ
Squirrelmail
Squirrelmail
–
7%
Aug 18Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as…
CVE-2004-0521
SQ
Squirrelmail
Squirrelmail
–
3%
Aug 18SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abook_database.php