Evil-DB LogoEvil-DB
← All CVEs

CVE-2004-0519

medium · 6.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.

6.8
CVSS
22.5%
EPSS (exploit prob.)
98th
EPSS percentile
2004-08-18
Published

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

VendorProductAffected versions
sgipropack3.0
squirrelmailsquirrelmail1.0.4
squirrelmailsquirrelmail1.0.5
squirrelmailsquirrelmail1.2.0
squirrelmailsquirrelmail1.2.1
squirrelmailsquirrelmail1.2.2
squirrelmailsquirrelmail1.2.3
squirrelmailsquirrelmail1.2.4
squirrelmailsquirrelmail1.2.5
squirrelmailsquirrelmail1.2.6
squirrelmailsquirrelmail1.2.7
squirrelmailsquirrelmail1.2.8
squirrelmailsquirrelmail1.2.9
squirrelmailsquirrelmail1.2.10
squirrelmailsquirrelmail1.2.11
squirrelmailsquirrelmail1.4
squirrelmailsquirrelmail1.4.1
squirrelmailsquirrelmail1.4.2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2004-0519