https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2006-5167.htmlhttps://patchthecve.com/cve/CVE-2006-5167.htmlTue, 16 Jun 2026 22:30:37 +0000MEDIUM 5.1: Multiple PHP remote file inclusion vulnerabilities in BasiliX 1.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) BSX_LIBDIR parameter in scripts in /files/ including (a) abook.php3, (b) compose-attach.php3, (c) compose-menu.php3, (d) compose-new.php3, (e) comhttps://patchthecve.com/cve/CVE-2002-1711.htmlhttps://patchthecve.com/cve/CVE-2002-1711.htmlTue, 16 Jun 2026 21:59:49 +0000LOW 2.1: BasiliX 1.1.0 saves attachments in a world readable /tmp/BasiliX directory, which allows local users to read other users' attachments.https://patchthecve.com/cve/CVE-2002-1710.htmlhttps://patchthecve.com/cve/CVE-2002-1710.htmlTue, 16 Jun 2026 21:59:49 +0000LOW 3.6: The attachment capability in Compose Mail in BasiliX Webmail 1.1.0 does not check whether the attachment was uploaded by the user or came from a HTTP POST, which could allow local users to steal sensitive information like a password file.https://patchthecve.com/cve/CVE-2002-1709.htmlhttps://patchthecve.com/cve/CVE-2002-1709.htmlTue, 16 Jun 2026 21:59:49 +0000MEDIUM 6.4: SQL injection vulnerability in BasiliX Webmail 1.10 allows remote attackers to obtain sensitive information or possibly modify data via the id variable.https://patchthecve.com/cve/CVE-2002-1708.htmlhttps://patchthecve.com/cve/CVE-2002-1708.htmlTue, 16 Jun 2026 21:59:49 +0000MEDIUM 6.8: Cross-site scripting vulnerability (XSS) in BasiliX Webmail 1.10 allows remote attackers to execute arbitrary script as other users by injecting script into the (1) subject or (2) message fields.https://patchthecve.com/cve/CVE-2001-1045.htmlhttps://patchthecve.com/cve/CVE-2001-1045.htmlTue, 16 Jun 2026 21:55:28 +0000MEDIUM 5.0: Directory traversal vulnerability in basilix.php3 in Basilix Webmail 1.0.3beta and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the request_id[DUMMY] parameter.https://patchthecve.com/cve/CVE-2001-1044.htmlhttps://patchthecve.com/cve/CVE-2001-1044.htmlTue, 16 Jun 2026 21:55:28 +0000HIGH 7.5: Basilix Webmail 0.9.7beta, and possibly other versions, stores *.class and *.inc files under the document root and does not restrict access, which could allows remote attackers to obtain sensitive information such as MySQL passwords and usernames from the mysql.class file.