Daniel Fernã¡Ndez Bleda

Researcher fromInternet Security Auditors

#34757of 60,596

8.6Total CVSS

Vulnerabilities · 2

Medium

2

Horde Application Framework

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the administration interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the PATH INFO to specific PHP files, including `phpshell.php`, `cmdshell.php`, or `sqlshell.php` in the `admin/` directory. The issue is related to the `PHP SELF` variable.

Horde Groupware Webmail Edition

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via `data:text/html` values for the `HREF` attribute of an `A` element in an HTML e-mail message. This is due to improper handling of `data:` URIs.