CVE-2006-4953

HIGH 7.5CVE-2006-4953 · Published 23/09/2006 · updated 16/06/2026

In short

CVE-2006-4953 is a HIGH (CVSS 7.5) vulnerability affecting neon webmail (neosys).
Chance of exploitation in the next 30 days (EPSS): 3.8%, higher than 90.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
neon webmail neosys	`= 5.06= 5.07`	No fix yet

Description

Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the (1) adr_sortkey and (2) adr_sortkey_desc parameters in the (a) addrlist servlet, and the (3) sortkey and (4) sortkey_desc parameters in the (b) maillist servlet.

References

secunia.com/advisories/22029 · Patch
vuln.sg/neonmail506-en.html · Exploit
securityfocus.com/bid/20109 · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/29088

More vulnerabilities in neon webmail

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

neon webmail

neosys

= 5.06= 5.07

No fix yet

Description

More vulnerabilities in neon webmail

See all →