Basilix maintains a narrowly scoped webmail application that, despite modest disclosure volume, has attracted public exploit development and tooling. The recurring weakness classifications reflect general application-layer vulnerabilities rather than a specific structural pattern, and defenders should track patches for this internet-facing product accordingly. Live exploitation activity, severity breakdown, and current exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Basilix over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2002-1708MEDIUM Cross-site scripting vulnerability (XSS) in BasiliX Webmail 1.10 allows remote attackers to execute arbitrary script as other users by injecting script into the (1) subject or (2) | Dec 31, 2002 | 6.8 | 34 | NO | YES |
CVE-2001-1044HIGH Basilix Webmail 0.9.7beta, and possibly other versions, stores *.class and *.inc files under the document root and does not restrict access, which could allows remote attackers to | Jan 11, 2001 | 7.5 | 31 | NO | YES |
CVE-2006-5167MEDIUM Multiple PHP remote file inclusion vulnerabilities in BasiliX 1.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) BSX_LIBDIR parameter in sc | Oct 5, 2006 | 5.1 | 23 | NO | YES |
CVE-2001-1045MEDIUM Directory traversal vulnerability in basilix.php3 in Basilix Webmail 1.0.3beta and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the request_id[DUMM | Jul 6, 2001 | 5.0 | 23 | NO | YES |
CVE-2002-1709MEDIUM SQL injection vulnerability in BasiliX Webmail 1.10 allows remote attackers to obtain sensitive information or possibly modify data via the id variable. | Dec 31, 2002 | 6.4 | 17 | NO | NO |
The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, which could allow local | Dec 31, 2002 | 3.6 | 13 | NO | NO |
BasiliX 1.1.0 saves attachments in a world readable /tmp/BasiliX directory, which allows local users to read other users' attachments. | Dec 31, 2002 | 2.1 | 11 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Basilix.
Media articles that mention a CVE ID that affects a product developed by Basilix — matched by CVE ID, not by vendor name.