CVE-2002-1341: Cross-site scripting (XSS) vulnerability in read_body.php for SquirrelMail 1.2.10, 1.2.9, and earlier allow...

Security readout for executives and security teams

This is an old cross-site scripting issue in SquirrelMail webmail. A remote attacker could make SquirrelMail render attacker-supplied script or HTML through specific request parameters. For an organization still exposing these legacy versions, the business risk is browser-based compromise of webmail users, not server takeover based on the supplied evidence. Exposure is most likely where legacy SquirrelMail is still deployed, especially internet-facing webmail. The affected version range is SquirrelMail 1.2.10, 1.2.9, and earlier. The bundle’s structured affected product data is incomplete, so confirm by application and package version, not CPE alone. Treat this as a legacy-exposure cleanup item. It is not listed in KEV and no active exploitation is cited, but internet-facing obsolete webmail is high-value and should not remain exposed without vendor-supported updates. Mitigation focus: Upgrade or replace SquirrelMail versions 1.2.10, 1.2.9, and earlier.; Apply relevant Debian, Red Hat, Gentoo, or other vendor security updates.; Remove public access to unsupported SquirrelMail instances where upgrade is not immediately possible..

Prepared

Jul 1, 2026, 06:00 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.