CVE-2006-4953
Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote...
Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the (1) adr_sortkey and (2) adr_sortkey_desc parameters in the (a) addrlist servlet, and the (3) sortkey and (4) sortkey_desc parameters in the (b) maillist servlet.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the (1) adr_sortkey and (2) adr_sortkey_desc parameters in the (a) addrlist servlet, and the (3) sortkey and (4) sortkey_desc parameters in the (b) maillist servlet.
- Record
CVE-2006-4953- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the (1) adr_sortkey and (2) adr_sortkey_desc parameters in the (a) addrlist servlet, and the (3) sortkey and (4) sortkey_desc parameters in the (b) maillist servlet.
- Record
CVE-2006-4953- Updated
- 2026-11-02
EUVDEUVD-2006-4939 No score
Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the (1) adr_sortkey and (2) adr_sortkey_desc parameters in the (a) addrlist servlet, and the (3) sortkey and (4) sortkey_desc parameters in the (b) maillist servlet.
- Record
EUVD-2006-4939- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-chhx-5gj9-jmmc No score
Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote...
Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the (1) adr_sortkey and (2) adr_sortkey_desc parameters in the (a) addrlist servlet, and the (3) sortkey and (4) sortkey_desc parameters in the (b) maillist servlet.
- Record
GHSA-chhx-5gj9-jmmc- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | NeoSys Neon Webmail for Java 5.06/5.07 - 'addrlist' Servlet Multiple SQL Injections | 2006-09-20 |
| Exploit-DB | NeoSys Neon Webmail for Java 5.06/5.07 - 'maillist' Servlet Multiple SQL Injections | 2006-09-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-4953 is a high vulnerability (CVSS 7.5) in Neosys Neon Webmail, published September 23, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.84%, the 90th percentile. No source names a fixed version.