CVE-2006-2190: Cross-site scripting (XSS) vulnerability in ow-shared.pl in OpenWebMail (OWM) 2.51 and earlier allows remot...

Security readout for executives and security teams

CVE-2006-2190 is a cross-site scripting issue in OpenWebMail 2.51 and earlier. If users visit a crafted link, an attacker may run script in their browser in the webmail context. Business risk depends on whether legacy OpenWebMail is still internet-facing and used by authenticated staff. Exposure is likely limited to organizations still running OpenWebMail 2.51 or earlier. Public-facing webmail increases risk, especially where users rely on browser sessions for email, address book, calendar, or webdisk access. Treat as a legacy exposure cleanup item unless OpenWebMail 2.51 or earlier is still internet-facing. If present, prioritize remediation because webmail sessions and user trust are sensitive even without confirmed active exploitation. Mitigation focus: Inventory any OpenWebMail deployments and confirm versions.; Move off OpenWebMail 2.51 and earlier using vendor guidance.; Review the OpenWebMail 2.52 announcement and rev 233 source diff..

Prepared

Jun 29, 2026, 12:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.