Every CVE Search/ Get API key

CVE-2006-6142

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow...

6.8 MediumFix available

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."

Exploit likelihood

2.51%Down 1.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."

Record
CVE-2006-6142
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."

Record
CVE-2006-6142
Updated
2026-11-02
EUVDEUVD-2006-6125 No score

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."

Record
EUVD-2006-6125
Updated
2026-11-03
GitHub AdvisoriesGHSA-58cj-jwpm-3hvq No score

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow...

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."

Record
GHSA-58cj-jwpm-3hvq
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
squirrelmail
Debian:3.1
 before 2:1.4.4-10, plus listed versions
2:1.4.4-52:1.4.4-62:1.4.4-6sarge12:1.4.4-72:1.4.4-82:1.4.4-9
2:1.4.4-10
squirrelmail
Red Hat:enterprise_linux:3::as
 before 0:1.4.8-4.el3
0:1.4.8-4.el3
squirrelmail
Red Hat:enterprise_linux:3::desktop
 before 0:1.4.8-4.el3
0:1.4.8-4.el3
squirrelmail
Red Hat:enterprise_linux:3::es
 before 0:1.4.8-4.el3
0:1.4.8-4.el3
squirrelmail
Red Hat:enterprise_linux:3::ws
 before 0:1.4.8-4.el3
0:1.4.8-4.el3
squirrelmail
Red Hat:enterprise_linux:4::as
 before 0:1.4.8-4.el4
0:1.4.8-4.el4
squirrelmail
Red Hat:enterprise_linux:4::desktop
 before 0:1.4.8-4.el4
0:1.4.8-4.el4
squirrelmail
Red Hat:enterprise_linux:4::es
 before 0:1.4.8-4.el4
0:1.4.8-4.el4
squirrelmail
Red Hat:enterprise_linux:4::ws
 before 0:1.4.8-4.el4
0:1.4.8-4.el4

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-6142 is a medium vulnerability (CVSS 6.8) in Squirrelmail, published December 5, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. Fixed in squirrelmail 2:1.4.4-10.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open