frameset.php in V-webmail 1.6.2 allows remote attackers to conduct phishing attacks by referencing arbitrary websites in the rframe parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
https://exchange.xforce.ibmcloud.com/vulnerabilities/24753
http://www.vupen.com/english/advisories/2006/0639