CVE-2006-2666: PHP remote file inclusion vulnerability in includes/mailaccess/pop3.php in V-Webmail 1.5 through 1.6.4 allo...

Security readout for executives and security teams

V-Webmail versions 1.5 through 1.6.4 have a remote file inclusion flaw that can let an outside attacker run PHP code on the server. For any surviving internet-facing deployment, this is a serious server compromise risk. The source bundle does not name a fixed version. Exposure is limited to organizations still running V-Webmail 1.5 through 1.6.4, especially if reachable from the internet. The affected-product metadata is incomplete, so validate by application inventory and file/version checks rather than relying on CPE matching. Prioritize any internet-facing legacy V-Webmail instance for rapid isolation or retirement. Business urgency is high because successful exploitation could mean server-level code execution, but scope may be narrow if the product is no longer deployed. Mitigation focus: Inventory and remove or isolate V-Webmail 1.5 through 1.6.4 deployments.; Check vendor or archived project guidance; the bundle does not name a fixed release.; Restrict public access to V-Webmail while exposure is being validated..

Prepared

Jun 29, 2026, 12:30 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.