{"id":"CVE-2006-4954","aliases":["EUVD-2006-4940","GHSA-6mc6-x498-8q9c"],"status":"published","title":"The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter...","description":"The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0813,"percentile":0.94878,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2006-09-23T10:00:00Z","modified":"2026-06-16T22:30:11Z","exploits":[{"source":"exploitdb","id":"EDB-28609","title":"NeoSys Neon Webmail for Java 5.06/5.07 - 'updateuser?in_id' Servlet Arbitrary User Information Modification","type":"webapps","platform":"jsp","date":"2006-09-20","verified":true,"url":"https://www.exploit-db.com/exploits/28609"}],"products":[{"vendor":"neosys","product":"neon_webmail"}],"references":[{"url":"http://www.securityfocus.com/bid/20109","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch"]},{"url":"http://vuln.sg/neonmail506-en.html","tags":["x_refsource_MISC","x_transferred","Exploit","Patch"]},{"url":"http://secunia.com/advisories/22029","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/29089","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.securityfocus.com/bid/84203","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-4954"},{"url":"https://github.com/advisories/GHSA-6mc6-x498-8q9c"}],"sources":{"cve":[{"id":"CVE-2006-4954","description":"The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.","status":"published","published":"2006-09-23T10:00:00Z","modified":"2024-08-07T19:32:22.338Z","updated_at":"2026-11-02T14:33:51.085765Z"}],"euvd":[{"id":"EUVD-2006-4940","description":"The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.","status":"published","published":"2006-09-23T10:00:00Z","modified":"2024-08-07T19:32:22Z","updated_at":"2026-11-03T01:15:49.872879Z"}],"ghsa":[{"id":"GHSA-6mc6-x498-8q9c","title":"The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter...","description":"The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.","status":"published","published":"2022-05-01T07:23:26Z","modified":"2023-01-31T05:02:21Z","updated_at":"2026-11-02T14:48:14.417535Z"}],"nvd":[{"id":"CVE-2006-4954","description":"The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.","status":"published","published":"2006-09-23T10:07:00Z","modified":"2026-06-16T22:30:11.59Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:01:06.675668Z"}]}}