Socketmail is a focused mail server product whose vulnerability footprint centers on web-facing input and request handling, with recurring issues in code injection, cross-site scripting, and cross-site request forgery. These weakness classes reflect the application-layer parsing and form-processing demands of a web-accessible mail interface, and defenders should prioritize inventory and patching of exposed instances. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Socketmail over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-5627MEDIUM PHP remote file inclusion vulnerability in content/fnc-readmail3.php in SocketMail 2.2.8 allows remote attackers to execute arbitrary PHP code via a URL in the __SOCKETMAIL_ROOT pa | Oct 23, 2007 | 6.8 | 27 | NO | YES |
CVE-2006-2681MEDIUM PHP remote file inclusion vulnerability in SocketMail Lite and Pro 2.2.6 and earlier, when register_globals and magic_quotes are enabled, allows remote attackers to execute arbitra | May 31, 2006 | 6.8 | 27 | NO | YES |
CVE-2007-5649MEDIUM Cross-site scripting (XSS) vulnerability in lostpwd.php in Creative Digital Resources SocketMail 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the lost_i | Oct 23, 2007 | 4.3 | 21 | NO | YES |
CVE-2012-4059MEDIUM Cross-site request forgery (CSRF) vulnerability in home/secretqtn.php in SocketMail Pro 2.2.9 allows remote attackers to hijack the authentication of arbitrary users for requests t | Jul 25, 2012 | 6.8 | 20 | NO | NO |
CVE-2012-4058MEDIUM Cross-site scripting (XSS) vulnerability in SocketMail Pro 2.2.9 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. | Jul 25, 2012 | 4.3 | 16 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Socketmail.
Media articles that mention a CVE ID that affects a product developed by Socketmail — matched by CVE ID, not by vendor name.