CVE catalog

CVE-2016-2228

php-horde: CVE-2016-2228

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.87% · Oct 25, 2026

Cross-site scripting (XSS) vulnerability in horde/templates/topbar/_menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter, as demonstrated by a request to xplorer/gollem/manager.php.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-hordesid5.2.23+debian0-6fixed
Debianphp-hordebookworm5.2.23+debian0-6fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-hordesourcesid5.2.9+debian0-1not yet assignedNot reported[813573]
Debianphp-hordesourcebookworm5.2.9+debian0-1not yet assignedNot reported[813573]

[Debian bug #813573]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-horde]Fixed
    Details (2)

    • 5.2.23+debian0-6 · all · bookworm

      Fixed · Fixed: 5.2.9+debian0-1

      dsa · php-horde · debian · bookworm; dsa · php-horde · debian · 12

    • 5.2.23+debian0-6 · all · bookworm

      Fixed · Fixed: 5.2.9+debian0-1

      dsa · php-horde · debian · bookworm; dsa · php-horde · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]