https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2006-0895.htmlhttps://patchthecve.com/cve/CVE-2006-0895.htmlTue, 16 Jun 2026 22:21:31 +0000MEDIUM 5.0: NOCC Webmail 1.0 allows remote attackers to obtain the installation path via a direct request to html/header.php.https://patchthecve.com/cve/CVE-2006-0894.htmlhttps://patchthecve.com/cve/CVE-2006-0894.htmlTue, 16 Jun 2026 22:21:30 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the html_error_occurred parameter in error.php, (2) html_filter_select parameter in filter_prefs.php, (3) html_no_mail parameter in no_mail.php, the (4) page_https://patchthecve.com/cve/CVE-2006-0893.htmlhttps://patchthecve.com/cve/CVE-2006-0893.htmlTue, 16 Jun 2026 22:21:30 +0000MEDIUM 5.0: NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to (1) the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and (2) the tmp directory, which lists names of uploaded attachments.https://patchthecve.com/cve/CVE-2006-0892.htmlhttps://patchthecve.com/cve/CVE-2006-0892.htmlTue, 16 Jun 2026 22:21:30 +0000HIGH 7.5: NOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames, which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities.https://patchthecve.com/cve/CVE-2006-0891.htmlhttps://patchthecve.com/cve/CVE-2006-0891.htmlTue, 16 Jun 2026 22:21:30 +0000MEDIUM 5.0: Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accephttps://patchthecve.com/cve/CVE-2002-2343.htmlhttps://patchthecve.com/cve/CVE-2002-2343.htmlTue, 16 Jun 2026 22:01:07 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in NOCC 0.9 through 0.9.5 allows remote attackers to inject arbitrary web script or HTML via email messages.