{"id":"CVE-2004-0519","aliases":["DSA-535","EUVD-2004-0518","GHSA-w2mg-247r-4xfc","RHSA-2004:240"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers...","description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.22528,"percentile":0.97721,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2004-06-03T04:00:00Z","modified":"2026-06-16T22:05:48Z","exploits":[{"source":"exploitdb","id":"EDB-24068","title":"SquirrelMail 1.4.x - Folder Name Cross-Site Scripting","type":"webapps","platform":"php","date":"2004-04-30","verified":true,"url":"https://www.exploit-db.com/exploits/24068"},{"source":"nuclei","id":"CVE-2004-0519","title":"SquirrelMail 1.4.x - Folder Name Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2004/CVE-2004-0519.yaml"}],"affected":[{"source":"osv","ecosystem":"Debian:3.0","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.6-1.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-0.e3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-0.e3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-0.e3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-0.e3.1"}]}],"bundled":3}],"products":[{"vendor":"sgi","product":"propack"},{"vendor":"squirrelmail","product":"squirrelmail"}],"references":[{"url":"http://secunia.com/advisories/12289","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Patch"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/16025","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/361857","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.novell.com/linux/security/advisories/2005_19_sr.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1006","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://www.securityfocus.com/advisories/6827","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/11531","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/11686","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/11870","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.debian.org/security/2004/dsa-535","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Patch","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2004-240.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Patch","Vendor Advisory"]},{"url":"https://bugzilla.fedora.us/show_bug.cgi?id=1733","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Patch"]},{"url":"http://security.gentoo.org/glsa/glsa-200405-16.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10274","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=108334862800260","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"ftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.asc","tags":["vendor-advisory","x_refsource_SGI","x_transferred","Patch"]},{"url":"http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000858","tags":["vendor-advisory","x_refsource_CONECTIVA","x_transferred"]},{"url":"http://www.securityfocus.com/bid/10246","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-0519","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w2mg-247r-4xfc"},{"url":"https://access.redhat.com/errata/RHSA-2004:240","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"http://marc.theaimsgroup.com/?l=squirrelmail-announce\u0026m=108595407012256","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=122512","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_240.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2004-0519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617220","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-0519","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2004-0520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-0520","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-0520","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2004-0521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617222","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-0521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-0521","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2004-0519","description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.","status":"published","published":"2004-06-03T04:00:00Z","modified":"2024-08-08T00:17:15.176Z","updated_at":"2026-11-02T14:34:54.758165Z"}],"euvd":[{"id":"EUVD-2004-0518","description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.","status":"published","published":"2004-06-03T04:00:00Z","modified":"2024-08-08T00:17:15Z","updated_at":"2026-11-03T01:15:19.183327Z"}],"ghsa":[{"id":"GHSA-w2mg-247r-4xfc","title":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers...","description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.","status":"published","published":"2022-05-03T03:13:05Z","modified":"2023-02-01T05:01:10Z","updated_at":"2026-11-02T14:49:41.113902Z"}],"nvd":[{"id":"CVE-2004-0519","description":"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.","status":"published","published":"2004-08-18T04:00:00Z","modified":"2026-06-16T22:05:48.06Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:00:51.000028Z"}],"osv":[{"id":"DSA-535","title":"squirrelmail - several vulnerabilities","status":"published","published":"2004-08-02T00:00:00Z","modified":"2026-03-09T02:10:23.465052Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"RHSA-2004:240","title":"Red Hat Security Advisory: squirrelmail security update","status":"published","published":"2024-09-15T14:41:03Z","modified":"2025-11-22T10:03:35Z","updated_at":"2026-11-02T15:52:59.135214Z"}]}}