CVE-2002-1650: The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execut...

Security readout for executives and security teams

This issue affects old SquirrelMail installations before 1.2.3. A spell checker plugin parameter could let a remote attacker run commands on the server. Business risk is concentrated in legacy internet-facing webmail systems. The provided sources do not document active exploitation. Likely exposure is limited to legacy SquirrelMail deployments, especially versions before 1.2.3 with the spell checker plugin reachable through webmail. Modern environments are exposed only if they still run this obsolete software or preserved copies in test, intranet, or unmanaged hosting systems. Prioritize any internet-facing SquirrelMail instance before 1.2.3 for urgent remediation or retirement. This is old software, but remote command execution on a mail server can affect sensitive communications and provide a foothold into wider infrastructure. Mitigation focus: Upgrade SquirrelMail to version 1.2.3 or later where still in use.; Disable or remove the spell checker plugin if immediate upgrade is not possible.; Restrict access to legacy webmail behind trusted networks or authentication controls..

Prepared

Jun 29, 2026, 22:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.