CVE-2008-3060: V-Webmail

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

V-webmail 1.5.0 allows remote attackers to obtain sensitive information via (1) malformed input in the login page (includes/local.hooks.php) and (2) an invalid session ID, which reveals the installation path in an error message.

Affected products

• V-Webmail V-Webmail: version 1.5.0 only

Published 2008-10-08. Last modified 2026-06-16.