$ cve CVE-2006-2842 JSON

CVE-2006-2842 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 44% (pctl 99)

Patch early

A public exploit exists.

Description

PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	44.02% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-06-06
Last modified	2026-06-16

Affected (1)

Vendor	Product
squirrelmail	squirrelmail

Public exploits

Source	Title	Date
exploit-db	Squirrelmail 1.4.x - 'Redirect.php' Local File Inclusion	2006-06-02

References

→ the Explorer · watch your stack · NVD