CVE-2005-2095

options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the...

4.3 MediumPublic exploit

options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting XSS) attacks, and write arbitrary files.

Exploit likelihood

4.24%Down 1.4 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2005-2095
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2005-2095
Updated: 2026-11-02

EUVDEUVD-2005-2096 No score

Record: EUVD-2005-2096
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wj45-2qrw-hh28 No score

options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the...

Record: GHSA-wj45-2qrw-hh28
Updated: 2026-11-02

Affected products

squirrelmail

Affected packages

Affected packages
Package	Affected	Fixed
`squirrelmail` Debian:3.0 From an advisory covering 2 CVEs	before 1:1.2.6-4, plus listed versions 1:1.2.6-1.41:1.2.6-21:1.2.6-3	1:1.2.6-4
`squirrelmail` Debian:3.1 From an advisory covering 2 CVEs	before 2:1.4.4-6sarge1, plus listed versions 2:1.4.4-52:1.4.4-6	2:1.4.4-6sarge1
`squirrelmail` Red Hat:enterprise_linux:3::as From an advisory covering 2 CVEs	before 0:1.4.3a-11.EL3	0:1.4.3a-11.EL3
`squirrelmail` Red Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs	before 0:1.4.3a-11.EL3	0:1.4.3a-11.EL3
`squirrelmail` Red Hat:enterprise_linux:3::es From an advisory covering 2 CVEs	before 0:1.4.3a-11.EL3	0:1.4.3a-11.EL3
`squirrelmail` Red Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs	before 0:1.4.3a-11.EL3	0:1.4.3a-11.EL3
`squirrelmail` Red Hat:enterprise_linux:4::as From an advisory covering 2 CVEs	before 0:1.4.3a-12.EL4	0:1.4.3a-12.EL4
`squirrelmail` Red Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs	before 0:1.4.3a-12.EL4	0:1.4.3a-12.EL4
`squirrelmail` Red Hat:enterprise_linux:4::es From an advisory covering 2 CVEs	before 0:1.4.3a-12.EL4	0:1.4.3a-12.EL4
`squirrelmail` Red Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs	before 0:1.4.3a-12.EL4	0:1.4.3a-12.EL4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite	2015-07-14

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-2095 is a medium vulnerability (CVSS 4.3) in Squirrelmail, published July 13, 2005. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.24%, the 91st percentile. No source names a fixed version.

References

Show 21 moreShow less