CVE-2002-1276
An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the...
CVE-2002-1276 is a medium vulnerability (CVSS 4.3) in Squirrelmail, published November 7, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 71st percentile. Fixed in squirrelmail 1.2.6-1.1.
An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks.
Exploit likelihood
What each source reports
NVD Score used
An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks.
- Record
CVE-2002-1276- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks.
- Record
CVE-2002-1276- Updated
- 2026-11-02
EUVDEUVD-2002-1260 No score
An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks.
- Record
EUVD-2002-1260- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c544-w4qx-cm4p No score
An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the...
An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save the result back to that variable, leaving it open to cross-site scripting attacks.
- Record
GHSA-c544-w4qx-cm4p- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squirrelmailDebian:3.0 |
before 1.2.6-1.1 | 1.2.6-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |