CVE-2004-0520: Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers...

Security readout for executives and security teams

This issue lets an attacker place malicious browser content in an email header. When a SquirrelMail user views the message, their browser may run attacker-controlled script in the webmail session. That can expose mail data or actions available to the user, but the supplied sources do not show active exploitation. Exposure is limited to environments still running SquirrelMail versions before 1.4.3 or unpatched distributor packages. Internet-facing webmail raises risk because attackers can send crafted email to users who read mail through the vulnerable interface. Treat as a legacy exposure cleanup item. Prioritize quickly if SquirrelMail is still internet-facing or used by privileged staff. If SquirrelMail is absent, no action is needed beyond documenting non-exposure. Mitigation focus: Upgrade SquirrelMail to 1.4.3 or a vendor-patched package.; Review Debian, Red Hat, Gentoo, Fedora, and other relevant distributor advisories.; Inventory any legacy SquirrelMail deployments, including internal webmail portals..

Prepared

Jun 30, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.