CVE-2006-0712: mail_html template in Squishdot 1.5.0 and earlier does not properly validate the (1) email and (2) title va...

Security readout for executives and security teams

Squishdot 1.5.0 and earlier may let a remote user add unexpected email headers through email or title fields. In business terms, an exposed vulnerable site could be abused to send or shape email in ways that evade spam controls. The sources do not show confirmed active exploitation. Exposure is likely limited to organizations still running Squishdot 1.5.0 or earlier, especially where public users can submit email or title values that flow into mail_html email generation. Prioritize if Squishdot is still deployed or exposed to untrusted users. Otherwise, handle through legacy application cleanup and asset hygiene because evidence of active exploitation is not provided. Mitigation focus: Identify any Squishdot deployments and confirm exact versions.; Check Squishdot vendor guidance for a fixed release or template correction.; Disable or restrict affected mail features until validation is confirmed..

Prepared

Jun 29, 2026, 14:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.