CVE-2002-1710

BasiliX Webmail 1.1.0 (or lower) contains an Arbitrary File Disclosure vulnerability in the attachment handling of Compose Mail. The PHP-based script accepts a list of attachment names from the client but does not verify that those attachments were actually uploaded, allowing an attacker to retri...

CVE-2004-1498

CVE-2004-1498 describes a SQL injection in the compose message form of HELM up to version 3.1.19, exploitable via the messageToUserAccNum parameter. The issue allows remote attackers to run arbitrary SQL commands. Affected: HELM 3.1.19 and earlier (HELM frontend/compose logic). Root cause: unsafe...

security flaw

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php...