horde

5 results · Clear filters · Feed

• Medium 6.1
  CVE-2026-65053

  Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

  Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns…

  horde imp php-horde-imp php-horde-imp Debian Ubuntu
  Aug 24, 2026
• Medium 6.5
  CVE-2026-58451

  Horde IMP < 7.0.1 Path Traversal via Compose.php img src

  Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers c…

  horde imp php-horde-imp php-horde-imp Debian Ubuntu
  Jul 1, 2026
• Medium 6.9
  CVE-2025-41066

  Disclosure of sensitive information in Horde Groupware

  Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the …

  horde Groupware php-horde-groupware php-horde-groupware Debian Ubuntu
  Dec 2, 2025
• Medium 6.3
  CVE-2020-8865 Public exploit

  This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webm…

  horde Groupware Webmail Edition php-horde-trean php-horde-trean Debian Ubuntu
  Mar 23, 2020
• Medium 4.3
  CVE-2020-8866 Public exploit

  This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webma…

  horde Groupware Webmail Edition php-horde-form php-horde-form Debian Ubuntu
  Mar 23, 2020