Open Webmail is a web-based email client whose vulnerability profile, while concentrated in a single product, reflects the inherent risks of browser-exposed mail interfaces: the recurring weakness classes include cross-site scripting, sensitive-information exposure, and input-neutralization failures that arise from rendering user-controlled content. Vulnerabilities in this product frequently acquire public exploit code, making timely patching important for deployments. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Open Webmail over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2004-0639MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in rea | Aug 6, 2004 | 6.8 | 34 | NO | YES |
CVE-2004-0520MEDIUM Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as | Aug 18, 2004 | 6.8 | 29 | NO | YES |
CVE-2004-2284HIGH The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename ar | Dec 31, 2004 | 10.0 | 25 | NO | NO |
CVE-2005-1435HIGH Open WebMail (OWM) before 2.51 20050430 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a filename. | May 3, 2005 | 7.5 | 20 | NO | NO |
CVE-2002-2410MEDIUM openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote atta | Dec 31, 2002 | 5.0 | 19 | NO | NO |
CVE-2006-2190MEDIUM Cross-site scripting (XSS) vulnerability in ow-shared.pl in OpenWebMail (OWM) 2.51 and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionid para | May 4, 2006 | 6.8 | 18 | NO | NO |
CVE-2002-1385HIGH openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessioni | Dec 26, 2002 | 7.2 | 18 | NO | NO |
CVE-2004-2458MEDIUM Open WebMail 2.30 and earlier, when use_syshomedir is disabled or create_syshomedir is enabled, creates new directories before authenticating, which allows remote attackers to crea | Dec 31, 2004 | 5.0 | 15 | NO | NO |
CVE-2007-4172MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Open Webmail (OWM) 2.52 20060831 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search | Aug 7, 2007 | 4.3 | 14 | NO | NO |
CVE-2006-3233MEDIUM Cross-site scripting (XSS) vulnerability in openwebmail-read.pl in Open WebMail (OWM) 2.52, and other versions released before 06/18/2006, allows remote attackers to inject arbitra | Jun 27, 2006 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Open Webmail.
Media articles that mention a CVE ID that affects a product developed by Open Webmail — matched by CVE ID, not by vendor name.