CVE-2006-4019

CVE-2006-4019 describes a dynamic variable evaluation vulnerability in SquirrelMail versions 1.4.0 through 1.4.7, specifically within the compose.php script. This flaw allows unauthenticated remote attackers to overwrite arbitrary program variables, potentially leading to unauthorized access to other users' attachments and preferences. With a CVSS score of 6.4 (medium severity) and an EPSS score indicating higher than 96% of all CVEs, the vulnerability is easily exploitable over the network with low attack complexity, resulting in partial confidentiality and integrity impacts. While not listed on CISA's KEV catalog, exploit code is publicly available via ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.