Description
Multiple SQL injection vulnerabilities in the (1) calendar and (2) infolog modules for phpgroupware 0.9.14 allow remote attackers to perform unauthorized database operations.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | phpgroupware | 0.9.14-0.RC3.2.woody3 | DSA-419 |
Advisories 1
- DSA-419 phpgroupware - missing filename sanitising, SQL injection Debian Security (DSA / DLA) · Mar 9, 2026