CVE-2007-1515

Horde IMP < 4.1.3 - Cross-Site Scripting via Email Subject Header or Search Parameters

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Immerda Project Group · textwebappsphp
https://www.exploit-db.com/exploits/29742

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1017774
Exploit, Vendor Advisory mailing-list x_refsource_fulldisc
http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html
Patch, Vendor Advisory mailing-list x_refsource_mlist
http://lists.horde.org/archives/announce/2007/000316.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/462914/100/0/threaded
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/0964
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24541
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/22975

Scores

EPSS 0.0119
EPSS Percentile 79.0%

Details

Status published
Products (1)
horde/imp < 4.1.3
Published Mar 20, 2007
Tracked Since Feb 18, 2026