CVE-2006-3665: Squirrelmail

Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days.

SquirrelMail 1.4.6 and earlier, with register_globals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this.

Affected products

• Squirrelmail Squirrelmail: version 1.4.6 only

Published 2006-07-18. Last modified 2026-06-16.