CVE-2018-14955

The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).

• CWE-79

• http://www.openwall.com/lists/oss-security/2018/07/26/2Mailing List, Third Party Advisory
• https://bugs.debian.org/905023Issue Tracking, Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5FP5O562A4FM5TCFNEW73SS6PZONSAC/
• https://sourceforge.net/p/squirrelmail/bugs/2831/Exploit, Issue Tracking, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2018/07/26/2Mailing List, Third Party Advisory
• https://bugs.debian.org/905023Issue Tracking, Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5FP5O562A4FM5TCFNEW73SS6PZONSAC/
• https://sourceforge.net/p/squirrelmail/bugs/2831/Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Aug 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1495IBM FlashSystem V840 and V900 products could allow an authen…6.5
• CVE-2018-14950The mail message display page in SquirrelMail through 1.4.22…
• CVE-2018-14951The mail message display page in SquirrelMail through 1.4.22…
• CVE-2018-14952The mail message display page in SquirrelMail through 1.4.22…
• CVE-2018-14953The mail message display page in SquirrelMail through 1.4.22…
• CVE-2018-14954The mail message display page in SquirrelMail through 1.4.22…
• CVE-2018-14956CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaw…
• CVE-2018-14957CMS ISWEB 3.5.3 is vulnerable to directory traversal and loc…
• CVE-2018-14958An issue was discovered in WeaselCMS v0.3.5. CSRF can update…
• CVE-2018-14959An issue was discovered in WeaselCMS v0.3.5. CSRF can create…
• CVE-2018-1496IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 …5.4
• CVE-2018-14960Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.