« Back to list

CVE-2006-0712

Status: ModifiedMedium (5)—

mail_html template in Squishdot 1.5.0 and earlier does not properly validate the (1) email and (2) title variables, which allows remote attackers to bypass spam filters by injecting SMTP headers, probably due to a CRLF injection vulnerability.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Squishdot — Squishdot

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2006-0712",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-02-15T11:06:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/18868",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/16667",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.squishdot.org/1139510883",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/0551",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24659",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/18868",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/16667",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.squishdot.org/1139510883",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/0551",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24659",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "mail_html template in Squishdot 1.5.0 and earlier does not properly validate the (1) email and (2) title variables, which allows remote attackers to bypass spam filters by injecting SMTP headers, probably due to a CRLF injection vulnerability."
    }
  ],
  "lastModified": "2026-06-16T22:21:08.050",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:squishdot:squishdot:0.7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28514472-52C3-44AD-99F4-688A0D95F30E"
            },
            {
              "criteria": "cpe:2.3:a:squishdot:squishdot:1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A027BB31-F34B-4060-8B37-D4D9974EA5BC"
            },
            {
              "criteria": "cpe:2.3:a:squishdot:squishdot:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B57484D-FE63-4F21-BC73-C56AE4BB972B"
            },
            {
              "criteria": "cpe:2.3:a:squishdot:squishdot:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "167C86AB-8BC4-4E73-96B5-7C2738E188E6"
            },
            {
              "criteria": "cpe:2.3:a:squishdot:squishdot:1.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B6872F8-F947-43F1-B7E7-701D4A432334"
            },
            {
              "criteria": "cpe:2.3:a:squishdot:squishdot:1.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E19789B4-446D-40B6-8395-61288C4A9E12"
            },
            {
              "criteria": "cpe:2.3:a:squishdot:squishdot:1.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE2189D8-4ACE-4113-BB74-721EA2AC95FA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}