CVE-2024-24133 | Critical | 9.8 | 2024-02-07 | Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page. |
CVE-2022-31200 | Medium | 6.1 | 2023-07-27 | Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field. |
CVE-2022-30776 | Medium | 6.1 | 2022-05-16 | atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter. |
CVE-2021-43574 | Medium | 6.1 | 2021-11-15 | WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affec… |
CVE-2012-2593 | Medium | 6.1 | 2020-02-06 | Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or… |
CVE-2017-11617 | Medium | 6.1 | 2017-07-25 | Cross-site scripting (XSS) vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of a… |
CVE-2017-9519 | High | 8.8 | 2017-06-08 | atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account. |
CVE-2017-9518 | High | 8.8 | 2017-06-08 | atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails. |
CVE-2017-9517 | High | 8.8 | 2017-06-08 | atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV. |
CVE-2013-2585 | | | 2014-02-12 | Cross-site scripting (XSS) vulnerability in Atmail Webmail Server 6.6.x before 6.6.3 and 7.0.x before 7.0.3 allows remote attackers to inject arbitrary web scr… |
CVE-2013-6229 | | | 2014-02-12 | Multiple cross-site scripting (XSS) vulnerabilities in Atmail Webmail Server 7.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) fi… |
CVE-2013-6028 | | | 2014-01-12 | Multiple cross-site request forgery (CSRF) vulnerabilities in Atmail Webmail Server before 7.2 allow remote attackers to hijack the authentication of administr… |
CVE-2013-6017 | | | 2014-01-12 | Cross-site scripting (XSS) vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an… |
CVE-2013-5034 | | | 2014-01-12 | Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CV… |
CVE-2013-5033 | | | 2014-01-12 | Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CV… |
CVE-2013-5032 | | | 2014-01-12 | Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CV… |
CVE-2013-5031 | | | 2014-01-12 | Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5032, CV… |
CVE-2012-1920 | | | 2012-03-27 | @Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request to install/info.ph… |
CVE-2012-1919 | | | 2012-03-27 | CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attac… |
CVE-2012-1918 | | | 2012-03-27 | Multiple directory traversal vulnerabilities in (1) compose.php and (2) libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow… |
CVE-2012-1917 | | | 2012-03-27 | compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which all… |
CVE-2012-1916 | | | 2012-03-27 | @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension… |
CVE-2011-4540 | | | 2011-12-01 | Multiple cross-site scripting (XSS) vulnerabilities in AtMail Open (aka AtMail Open-Source edition) 1.04 allow remote attackers to inject arbitrary web script… |
CVE-2010-4930 | | | 2011-10-09 | Cross-site scripting (XSS) vulnerability in index.php in @mail Webmail before 6.2.0 allows remote attackers to inject arbitrary web script or HTML via the Mail… |
CVE-2009-2455 | | | 2009-07-14 | Multiple cross-site scripting (XSS) vulnerabilities in webadmin/admin.php in @mail 5.6.1 allow remote attackers to inject arbitrary web script or HTML via the… |
CVE-2007-2825 | | | 2007-05-22 | Multiple cross-site scripting (XSS) vulnerabilities in ReadMsg.php in @Mail 5.02 and earlier allow remote attackers to inject arbitrary web script or HTML via… |
CVE-2007-2153 | | | 2007-04-19 | Cross-site scripting (XSS) vulnerability in atmail.php in @Mail 5.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter. |
CVE-2007-0953 | | | 2007-02-15 | Cross-site scripting (XSS) vulnerability in search.pl in @Mail 4.61 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords… |
CVE-2006-6704 | | | 2006-12-23 | Cross-site scripting (XSS) vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vec… |
CVE-2006-6702 | | | 2006-12-23 | Cross-site scripting (XSS) vulnerability in Global.pm in @Mail before 4.61 allows remote attackers to inject arbitrary web script or HTML via crafted e-mail me… |
CVE-2006-6701 | | | 2006-12-23 | Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary… |
CVE-2006-0611 | | | 2006-02-09 | Directory traversal vulnerability in compose.pl in @Mail 4.3 and earlier for Windows allows remote attackers to upload arbitrary files to arbitrary locations v… |