CVE-2006-2190

Published: May 4, 2006Modified: Apr 16, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in ow-shared.pl in OpenWebMail (OWM) 2.51 and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter in (1) openwebmail-send.pl, (2) openwebmail-advsearch.pl, (3) openwebmail-folder.pl, (4) openwebmail-prefs.pl, (5) openwebmail-abook.pl, (6) openwebmail-read.pl, (7) openwebmail-cal.pl, and (8) openwebmail-webdisk.pl. NOTE: the openwebmail-main.pl vector is already covered by CVE-2005-2863.

Affected (17)

Products: Open Webmail: Open Webmail

Open Webmail

1 product

Open Webmail

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Open Webmail Open Webmail	Up to 2.51
Open Webmail Open Webmail	Version 1.71
Open Webmail Open Webmail	Version 1.7
Open Webmail Open Webmail	Version 1.81
Open Webmail Open Webmail	Version 1.8
Open Webmail Open Webmail	Version 1.90
Open Webmail Open Webmail	Version 2.00
Open Webmail Open Webmail	Version 2.01
Open Webmail Open Webmail	Version 2.10
Open Webmail Open Webmail	Version 2.20
Open Webmail Open Webmail	Version 2.21
Open Webmail Open Webmail	Version 2.30
Open Webmail Open Webmail	Version 2.31
Open Webmail Open Webmail	Version 2.32
Open Webmail Open Webmail	Version 2.40
Open Webmail Open Webmail	Version 2.41
Open Webmail Open Webmail	Version 2.50