Volerion logoVolerion
Volerion logoVolerion

SquirrelMail Cross-Site Scripting Vulnerability in Email Header Processing

Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in SquirrelMail versions through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401. The issue arises in mime.php, where JavaScript payloads in email headers are improperly handled, allowing for XSS attacks on both the message list and message display.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to the latest SquirrelMail version or apply the available patches to address this vulnerability.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
3.4
impact
1.7
exploitability
6.5
remediation
7.7
relevance
0.0
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.