Description
Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selection box, allows remote attackers to inject arbitrary web script or HTML via the new_lang parameter to login.php.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | horde3 | 3.1.3-4etch1 | DSA-1406-1 |
| Debian 3.1 | horde3 | 3.0.4-4sarge6 | DSA-1406-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Horde Framework 3.1.3 - 'login.php' Cross-Site Scripting EDB-29745 · webapps · Mar 15, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-1406-1 horde3 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20070315 Horde 3.1.4 (RC1) fixes XSS issue mailing-list
- SUSE-SR:2007:007 vendor-advisory
- 24528 third-party-advisory
- 24995 third-party-advisory
- 27565 third-party-advisory
- horde-login-xss(33013) vdb-entry
- 2427 third-party-advisory
- 1017775 vdb-entry
- 22984 vdb-entry
- 33084 vdb-entry
- DSA-1406 vendor-advisory
- ADV-2007-0965 vdb-entry
- [announce] 20070314 Horde 3.1.4 (final) mailing-list