https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2006-2138.htmlhttps://patchthecve.com/cve/CVE-2006-2138.htmlTue, 16 Jun 2026 22:24:24 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.29 allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter.https://patchthecve.com/cve/CVE-2006-0711.htmlhttps://patchthecve.com/cve/CVE-2006-0711.htmlTue, 16 Jun 2026 22:21:07 +0000MEDIUM 5.0: The (1) addfolder and (2) deletefolder functions in neomail-prefs.pl in NeoMail 1.28 do not validate the Session ID, which allows remote attackers to add and delete arbitrary files, when configured with homedirfolders and homedirspools disabled.https://patchthecve.com/cve/CVE-2006-0536.htmlhttps://patchthecve.com/cve/CVE-2006-0536.htmlTue, 16 Jun 2026 22:20:47 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.27 allows remote attackers to inject arbitrary web script or HTML via the sort parameter. NOTE: some sources say that the affected parameter is "date," but the demonstration URL shows that it is "sort".