https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2006-4429.htmlhttps://patchthecve.com/cve/CVE-2006-4429.htmlTue, 16 Jun 2026 22:29:04 +0000HIGH 7.5: PHP remote file inclusion vulnerability in handlers/email/mod.output.php in PHlyMail Lite 3.4.4 and earlier (Build 3.04.04) allows remote attackers to execute arbitrary PHP code via a URL in the _PM_[path][handler] parameter, a different vector than CVE-2006-4291. NOTE: This issue has been disputedhttps://patchthecve.com/cve/CVE-2006-4291.htmlhttps://patchthecve.com/cve/CVE-2006-4291.htmlTue, 16 Jun 2026 22:28:47 +0000MEDIUM 5.1: PHP remote file inclusion vulnerability in handlers/email/mod.listmail.php in PHlyMail Lite 3.4.4 and earlier (Build 3.04.04) allows remote attackers to execute arbitrary PHP code via a URL in the _PM_[path][handler] parameter.https://patchthecve.com/cve/CVE-2005-4666.htmlhttps://patchthecve.com/cve/CVE-2005-4666.htmlTue, 16 Jun 2026 22:19:12 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in PHlyMail before 3.3 Beta1 allows remote attackers to inject arbitrary Javascript via unknown attack vectors.https://patchthecve.com/cve/CVE-2005-4652.htmlhttps://patchthecve.com/cve/CVE-2005-4652.htmlTue, 16 Jun 2026 22:19:10 +0000MEDIUM 6.4: SQL injection vulnerability in PHlyMail 3.02.01 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.https://patchthecve.com/cve/CVE-2005-2606.htmlhttps://patchthecve.com/cve/CVE-2005-2606.htmlTue, 16 Jun 2026 22:15:17 +0000HIGH 7.5: Unknown vulnerability in the "frontend authentication" in PHlyMail 3.02.00 has unknown impact and attack vectors.