Skip to content
Noroxi

phpgroupware records

27 published records for vendor phpgroupware.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
7
With a fix record
44.4%
Median publish → KEV
No record has entered KEV

Records by year

    Bar: total · dark part: CISA KEV.

    Recurring classes

    The weakness classes this vendor ships most often: where to look.

    CWE

    Attack profile

    All records

    27 records
    • CVE-2001-0043
      41Plan

      phpGroupWare before 0.9.7 allows remote attackers to execute arbitrary PHP commands by specifying a malicious include file in the phpgw_info

      CriticalCVSS 10.0No exploitEPSS 3%

      phpgroupware · phpgroupwareFeb 16, 2001

    • CVE-2003-0599
      41Plan

      Unknown vulnerability in the Virtual File System (VFS) capability for phpGroupWare 0.9.16preRC and versions before 0.9.14.004 with unknown i

      CriticalCVSS 10.0No exploitEPSS 2%

      phpgroupware · phpgroupwareAug 27, 2003

    • CVE-2004-2407
      40Plan

      Unknown vulnerability in phpGroupWare before 0.9.14.002 has unknown attack vectors and impact, related to a "security hole" in the Setup/Con

      CriticalCVSS 10.0No exploitEPSS 1%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2004-2406
      40Plan

      Unknown "overflow" in the phpgw_config table for phpGroupWare before 0.9.14.002 has unknown attack vectors and impact.

      CriticalCVSS 10.0No exploitEPSS 1%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2009-4415
      31Monitor

      Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attacker

      HighCVSS 7.5No exploitEPSS 3%

      phpgroupware · phpgroupwareDec 24, 2009

    • CVE-2004-1383
      31Monitor

      Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via

      HighCVSS 7.5Proof of conceptEPSS 3%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2004-2573
      31Monitor

      PHP remote file inclusion vulnerability in tables_update.inc.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to execute a

      HighCVSS 7.5Proof of conceptEPSS 3%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2002-0536
      31Monitor

      PHPGroupware 0.9.12 and earlier, when running with the magic_quotes_gpc feature disabled, allows remote attackers to compromise the database

      HighCVSS 7.5Proof of conceptEPSS 3%

      phpgroupware · phpgroupwareJul 3, 2002

    • CVE-2010-0404
      31Monitor

      Multiple SQL injection vulnerabilities in phpGroupWare (phpgw) before 0.9.16.016 allow remote attackers to execute arbitrary SQL commands vi

      HighCVSS 7.5No exploitEPSS 2%

      phpgroupware · phpgroupwareMay 19, 2010

    • CVE-2004-0016
      30Monitor

      The calendar module for phpgroupware 0.9.14 does not enforce the "save extension" feature for holiday files, which allows remote attackers t

      HighCVSS 7.5No exploitEPSS 2%

      phpgroupware · phpgroupwareFeb 3, 2004

    • CVE-2003-0657
      30Monitor

      Multiple SQL injection vulnerabilities in the infolog module for phpgroupware 0.9.14 and earlier could allow remote attackers to conduct una

      HighCVSS 7.5No exploitEPSS 1%

      phpgroupware · phpgroupwareAug 27, 2003

    • CVE-2004-0017
      30Monitor

      Multiple SQL injection vulnerabilities in the (1) calendar and (2) infolog modules for phpgroupware 0.9.14 allow remote attackers to perform

      HighCVSS 7.5No exploitEPSS 1%

      phpgroupware · phpgroupwareFeb 3, 2004

    • CVE-2005-3347
      28Monitor

      Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egr

      MediumCVSS 6.8No exploitEPSS 4%

      phpgroupware · phpgroupwareNov 17, 2005

    • CVE-2010-0403
      28Monitor

      Directory traversal vulnerability in about.php in phpGroupWare (phpgw) before 0.9.16.016 allows remote attackers to include and execute arbi

      MediumCVSS 6.8No exploitEPSS 2%

      phpgroupware · phpgroupwareMay 19, 2010

    • CVE-2004-0875
      27Monitor

      Multiple cross-site scripting (XSS) vulnerabilities in Phpgroupware (aka webdistro) 0.9.16.002 and earlier allow remote attackers to insert

      MediumCVSS 6.8No exploitEPSS 1%

      phpgroupware · phpgroupwareDec 23, 2004

    • CVE-2009-4414
      27Monitor

      SQL injection vulnerability in phpgwapi /inc/class.auth_sql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014

      MediumCVSS 6.8No exploitEPSS 1%

      phpgroupware · phpgroupwareDec 24, 2009

    • CVE-2006-4458
      26Monitor

      Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allows remote attackers t

      MediumCVSS 6.4Proof of conceptEPSS 3%

      phpgroupware · phpgroupwareAug 31, 2006

    • CVE-2004-1385
      22Monitor

      phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID su

      MediumCVSS 5.0Proof of conceptEPSS 7%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2004-2575
      20Monitor

      phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to (1) hook_admin.inc.php, (

      MediumCVSS 5.0No exploitEPSS 2%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2004-2576
      20Monitor

      class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-di

      MediumCVSS 5.0No exploitEPSS 2%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2004-2578
      20Monitor

      phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attacker

      MediumCVSS 5.0No exploitEPSS 1%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2004-2577
      20Monitor

      The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote

      MediumCVSS 5.0No exploitEPSS 1%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2004-1384
      18Monitor

      Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web sc

      MediumCVSS 4.3Proof of conceptEPSS 4%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2004-2574
      18Monitor

      Cross-site scripting (XSS) vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web

      MediumCVSS 4.3Proof of conceptEPSS 4%

      phpgroupware · phpgroupwareDec 31, 2004

    • CVE-2009-4416
      18Monitor

      Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remot

      MediumCVSS 4.3No exploitEPSS 2%

      phpgroupware · phpgroupwareDec 24, 2009