Horde vulnerabilitiesNone on the known-exploited list.
Horde has 114 published vulnerabilities across 160 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Groupware, with 45. If you run Horde software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which Horde products have the most vulnerabilities?
Groupware leads with 45 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Horde vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Horde's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Horde flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 72%CVE-2012-0209High
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in...
- 72%CVE-2020-8518Critical
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.
- 69%CVE-2022-30287High
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class.
- 43%CVE-2014-1691High
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object...
- 39%CVE-2017-7413High
In Horde_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their...
- 39%CVE-2006-1491High
Eval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execute arbitrary code via the help viewer.
- 28%CVE-2003-0025High
Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as check_prefs() in...
- 19%CVE-2019-9858High
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17.
- 12%CVE-2006-1260Medium
Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check.
- 9.6%CVE-2020-8866Medium
This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22.
All Horde products we track.
158 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Groupwaregroupware45 vulnerabilities76 versions
- Impimp21 vulnerabilities68 versions
- Hordehorde18 vulnerabilities45 versions
- Groupware Webmail Editiongroupware_webmail_edition10 vulnerabilities32 versions
- Horde Application Frameworkhorde_application_framework9 vulnerabilities137 versions
- Application Frameworkapplication_framework8 vulnerabilities33 versions
- Kronolithkronolith3 vulnerabilities69 versions
- Kronolith H3kronolith_h33 vulnerabilities22 versions
- Kronolith H4kronolith_h43 vulnerabilities19 versions
- Turba H3turba_h33 vulnerabilities26 versions
- Dynamic Impdynamic_imp2 vulnerabilities25 versions
- Gollemgollem2 vulnerabilities25 versions
- Horde Groupwarehorde_groupware2 vulnerabilities10 versions
- Horde Image APIhorde_image_api2 vulnerabilities23 versions
- Internet Mail Programinternet_mail_program2 vulnerabilities16 versions
- Mnemo H3mnemo_h32 vulnerabilities3 versions
- Nag H3nag_h32 vulnerabilities5 versions
- Passwdpasswd2 vulnerabilities5 versions
- Accountsaccounts1 vulnerability2 versions
- Chorachora1 vulnerability2 versions
- Forwardsforwards1 vulnerability3 versions
- Frameworkframework1 vulnerability1 version
- Horde Formhorde_form1 vulnerability28 versions
- Horde Imagehorde_image1 vulnerability45 versions
This directory lists the 158 Horde products with at least one tracked version, of 160 in our catalogue.
Running Horde? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers to execute arbitrary PHP code.
- Matched to
- Groupware on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 114 published vulnerabilities across 160 products and 3,123 versions from Horde.
None of Horde's vulnerabilities is on the list of flaws known to be exploited today.
Groupware, with 45 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Horde products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.