phpmywebhosting 0.3.4 has a SQL injection vulnerability where an attacker can be authenticated as an admin by just using [usr= admin"-(] and [pass="asdf].
67cc62c3244f69dcb87dc12efe4c2bf6440d68205346aeb7abb433a015e46d7d
The chpasswd binary plugin version 3.x that comes with SquirrelMail is susceptible to a buffer overflow.
51bed8c4cf3edfac90f26c1ed8d63cd3bf848fa26f97b3022a5c47a95bfe5974