CVE-2006-4953 — Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the (1) adr_sortkey and (2) adr_sortkey_desc parameters in the (a) addrlist servlet, and the (3) sortkey and (4) sortkey_desc parameters in the (b) maillist servlet

Back Back to CVE browser

HIGH

Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the (1) adr_sortkey and (2) adr_sortkey_desc parameters in the (a) addrlist servlet, and the (3) sortkey and (4) sortkey_desc parameters in the (b) maillist servlet

Published Sep 23, 2006

7.5

HIGH

CVSS 2.0

EPSS 3.76%

Description

Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the (1) adr_sortkey and (2) adr_sortkey_desc parameters in the (a) addrlist servlet, and the (3) sortkey and (4) sortkey_desc parameters in the (b) maillist servlet.

Affected products

Remediation

No remediation recorded yet.

Metrics

3.76% 0.03764

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.03764

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	3.76% (0.03764)	89.58th	v5 (v2026.06.15)
Jun 15, 2026	3.63% (0.03633)	88.04th	v5 (v2026.06.15)
Mar 17, 2025	0.43% (0.00432)	60.55th	v4 (v2025.03.14)
Dec 12, 2024	0.19% (0.00193)	58.16th	v3 (v2023.03.01)
Feb 16, 2024	0.19% (0.00193)	55.94th	v3 (v2023.03.01)
Jul 28, 2023	0.21% (0.00213)	58.36th	v3 (v2023.03.01)
Jun 20, 2023	0.18% (0.00180)	53.99th	v3 (v2023.03.01)
May 13, 2023	0.15% (0.00152)	50.04th	v3 (v2023.03.01)
Mar 7, 2023	0.16% (0.00159)	50.69th	v3 (v2023.03.01)
Mar 6, 2023	0.99% (0.00986)	37.57th	v2 (v2022.01.01)
Sep 9, 2022	0.99% (0.00986)	35.83th	v2 (v2022.01.01)
Apr 1, 2022	0.99% (0.00986)	33.83th	v2 (v2022.01.01)
Feb 4, 2022	0.99% (0.00986)	17.63th	v2 (v2022.01.01)

Weaknesses (0)

No CWE recorded.

References (4)

http://secunia.com/advisories/22029
third-party-advisoryx_refsource_SECUNIAPatchVendor Advisory
http://vuln.sg/neonmail506-en.html
x_refsource_MISCExploitPatch
http://www.securityfocus.com/bid/20109
vdb-entryx_refsource_BIDExploitPatch
https://exchange.xforce.ibmcloud.com/vulnerabilities/29088
vdb-entryx_refsource_XF

Link	Providers	Tags
http://secunia.com/advisories/22029		third-party-advisoryx_refsource_SECUNIAPatchVendor Advisory
http://vuln.sg/neonmail506-en.html		x_refsource_MISCExploitPatch
http://www.securityfocus.com/bid/20109		vdb-entryx_refsource_BIDExploitPatch
https://exchange.xforce.ibmcloud.com/vulnerabilities/29088		vdb-entryx_refsource_XF

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Sep 23, 2006

Updated Aug 7, 2024

Reserved Sep 22, 2006

Link CVE-2006-4953

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2006-4953

Red Hat

Severity n/a

Public date n/a

Links CVE-2006-4953