Horde Imp
23 CVEs affecting Horde Imp. Latest disclosed: 2026-07-01. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30349 | High | 7.2 | 2025-03-21 | Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail mes… |
CVE-2026-58451 | Medium | 6.5 | 2026-07-01 | Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server f… |
CVE-2002-2024 | Medium | 5.3 | 2002-12-31 | Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spel… |
CVE-2012-6640 | | 2014-04-05 | Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows re… | |
CVE-2012-5565 | | 2014-04-05 | Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition b… | |
CVE-2012-0791 | | 2012-01-24 | Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to injec… | |
CVE-2010-4778 | | 2011-04-04 | Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow re… | |
CVE-2010-3695 | | 2011-03-31 | Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attac… | |
CVE-2010-0463 | | 2010-01-29 | Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for… | |
CVE-2007-6018 | | 2008-01-11 | IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allow… | |
CVE-2007-1515 | | 2007-03-20 | Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML… | |
CVE-2007-1474 | | 2007-03-16 | Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delet… | |
CVE-2006-4255 | | 2006-08-21 | Cross-site scripting (XSS) vulnerability in horde/imp/search.php in Horde IMP H3 before 4.1.3 allows remote attackers to include arbitrary web script or HTML v… | |
CVE-2005-4080 | | 2005-12-08 | Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) att… | |
CVE-2005-1319 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Horde IMP Webmail client before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the parent… | |
CVE-2004-1443 | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in the inline MIME viewer in Horde-IMP (Internet Messaging Program) 3.2.4 and earlier, when used with Internet Explore… | |
CVE-2004-0584 | | 2004-08-06 | Unknown vulnerability in Horde IMP 3.2.3 and earlier, before a "security fix," does not properly validate input, which allows remote attackers to execute arbit… | |
CVE-2003-0025 | | 2003-01-17 | Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges… | |
CVE-2002-0181 | | 2002-04-22 | Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of ot… | |
CVE-2001-0744 | | 2001-10-18 | Horde IMP 2.2.4 and earlier allows local users to overwrite files via a symlink attack on a temporary file. |