PatchTheCVE: squirrelmailhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2020-14933: compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTPhttps://patchthecve.com/cve/CVE-2020-14933.htmlhttps://patchthecve.com/cve/CVE-2020-14933.htmlWed, 17 Jun 2026 02:55:47 +0000HIGH 8.8: compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. NOTE: the vendor disputes this because these two conditions for PHP object injection are not satisfied: existence of a PHP magic method (such as __wakeup or __destruct), and aCVE-2020-14932: compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP https://patchthecve.com/cve/CVE-2020-14932.htmlhttps://patchthecve.com/cve/CVE-2020-14932.htmlWed, 17 Jun 2026 02:55:47 +0000CRITICAL 9.8: compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php.CVE-2012-5623: Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords.https://patchthecve.com/cve/CVE-2012-5623.htmlhttps://patchthecve.com/cve/CVE-2012-5623.htmlTue, 16 Jun 2026 23:47:06 +0000HIGH 7.5: Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords.