Please do not recommend squirrelmail. It is not really being maintained.
https://www.openwall.com/lists/oss-security/2018/07/26/2
https://www.openwall.com/lists/oss-security/2018/03/17/2
https://www.openwall.com/lists/oss-security/2018/07/26/2
https://www.openwall.com/lists/oss-security/2018/03/17/2