Cross-site scripting (XSS) vulnerability in openwebmail-read.pl in Open WebMail (OWM) 2.52 and other versions released before 06/18/2006 allows remote attackers to inject arbitrary web script or HTML via the from field. NOTE: some third party sources have mentioned the \to\ and \from\ fields although CVE analysis shows that these are associated with the previous version a different executable and a different CVE.