CVE-2004-0639

Published: Aug 6, 2004Modified: Apr 16, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable.

Affected (21)

Products: Open Webmail: Open Webmail · Sgi: Propack · Squirrelmail: Squirrelmail

1 product

1 product

1 product

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Open Webmail Open Webmail	Version 2.30
Open Webmail Open Webmail	Version 2.31
Open Webmail Open Webmail	Version 2.32
Sgi Propack	Version 3.0
Squirrelmail Squirrelmail	Version 1.2.0
Squirrelmail Squirrelmail	Version 1.2.10
Squirrelmail Squirrelmail	Version 1.2.11
Squirrelmail Squirrelmail	Version 1.2.1
Squirrelmail Squirrelmail	Version 1.2.2
Squirrelmail Squirrelmail	Version 1.2.3
Squirrelmail Squirrelmail	Version 1.2.4
Squirrelmail Squirrelmail	Version 1.2.5
Squirrelmail Squirrelmail	Version 1.2.6
Squirrelmail Squirrelmail	Version 1.2.7
Squirrelmail Squirrelmail	Version 1.2.8
Squirrelmail Squirrelmail	Version 1.2.9
Squirrelmail Squirrelmail	Version 1.4.1
Squirrelmail Squirrelmail	Version 1.4.2
Squirrelmail Squirrelmail	Version 1.4.3_rc1
Squirrelmail Squirrelmail	Version 1.4
Squirrelmail Squirrelmail	Version 1.5_dev