Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2005-2183: PhpXmail lets attackers log in with oversized passwords
CVE-2005-2183 · published 21 years ago
Summary
Versions 0.7 through 1.1 of PhpXmail mishandle passwords that are longer than expected, so the software fails to show an error and lets a remote user skip the login check. This can give an unauthorized person access to the system. Apply the latest update or patch from the vendor and enforce password length limits to protect your installation.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| phpxmail | phpxmail |
0.7 1.1 cpe:2.3:a:phpxmail:phpxmail:0.7:*:*:*:*:*:*:* |
Original advisory text
class.xmail.php in PhpXmail 0.7 through 1.1 does not properly handle large passwords, which prevents an error message from being returned and allows remote attackers to bypass authentication and ga...
class.xmail.php in PhpXmail 0.7 through 1.1 does not properly handle large passwords, which prevents an error message from being returned and allows remote attackers to bypass authentication and gain unauthorized access.
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Timeline
Published11 Jul 2005
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-2183 · NVD
Track software like this
Free during beta