Squirrelmail vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-30090 mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishandHigh 7.2 · Apr 2, 2025
• CVE-2020-14933 compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request.High 8.8 · Jun 20, 2020
• CVE-2020-14932 compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request.Critical 9.8 · Jun 20, 2020
• CVE-2012-5623 Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords.High 7.5 · Feb 13, 2020
• CVE-2018-8741 A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related High 8.8 · Mar 17, 2018
• CVE-2017-7692 SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in High 8.8 · Apr 20, 2017
• CVE-2007-3778 The G/PGP (GPG) Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the mHigh 7.5 · Jul 15, 2007
• CVE-2007-3636 Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin 2.1 for Squirrelmail allow remote attackers to execute arbitrary commands via unspecified vectorsHigh 7.5 · Jul 9, 2007
• CVE-2007-2631 Cross-site request forgery (CSRF) vulnerability in SquirrelMail 1.4.8-4.fc6 and earlier allows remote attackers to perform unspecified actions as arbitrary userHigh 7.5 · May 13, 2007
• CVE-2006-2842 PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disablHigh 7.5 · Jun 6, 2006
• CVE-2005-1924 The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr pHigh 9.3 · Dec 31, 2005
• CVE-2005-0183 ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in a command line argHigh 7.2 · May 2, 2005
• CVE-2005-0239 viewcert.php in the S/MIME plugin 0.4 and 0.5 for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the cert parameHigh 7.5 · May 2, 2005
• CVE-2005-0152 PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via "URL manipulation."High 7.5 · Feb 2, 2005
• CVE-2005-0103 PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by modifying a URL parHigh 7.5 · Jan 24, 2005
• CVE-2002-1648 Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL High 7.5 · Dec 31, 2002
• CVE-2002-1650 The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command pHigh 7.5 · Dec 31, 2002
• CVE-2002-1131 Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2)High 7.5 · Oct 4, 2002
• CVE-2002-0516 SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie.High 10 · Aug 12, 2002
• CVE-2001-1159 load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers toHigh 7.5 · Jul 2, 2001