Skip to content
OpenAdvisories

Vendor

horde

7 known vulnerabilities.

Products

imp 3 Groupware Webmail Edition 2 Vfs 1 Groupware 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-60102

    Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver

    Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arb…

    horde Vfs php-horde-vfs php-horde-vfs Debian Ubuntu
  • High 7.2
    CVE-2025-30349 Public exploit EPSS 31%

    Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account tak…

    horde imp php-horde-imp php-horde Debian Ubuntu