1056 matches found
TikiWiki CMS Groupware v8.3 - Open Redirect
tiki-featuredlink.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection id: CVE-2012-5321 info: name: TikiWiki CMS Groupware v8.3 - Open Redirect author: ctflearner severity:...
Tiki Wiki CMS Groupware 5.2 - Local File Inclusion
Tiki Wiki CMS Groupware 5.2 is susceptible to a local file inclusion vulnerability. id: CVE-2010-4239 info: name: Tiki Wiki CMS Groupware 5.2 - Local File Inclusion author: 0xakoko severity: critical description: Tiki Wiki CMS Groupware 5.2 is susceptible to a local file inclusion vulnerability...
Horde Groupware Unauthenticated Admin Access
Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access. id: CVE-2005-3344 info: name: Horde Groupware Unauthenticated Admin Access author: pikpikcu severity: critical description: Horde Groupware contains an administrative account wi...
EUVD-2026-75272
An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...
PT-2026-89296
An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...
Horde Groupware Cross Site Scripting
Horde Groupware suffers from persistent cross site scripting and path traversal vulnerabilities. https://blog.evan.lat/posts/CVE-2026-65053/ the blog talks about two vulns that are chainable together. for the sake of brevity ill write up on the stored xss one. in lib/Mime/Status.php, we see a...
Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations
Overview A cross-site scripting XSS vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG Scalable Vector Graphics objects in ICS iCalendar invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTota...
Tiki Wiki CMS Groupware 5.2 - Cross-Site Scripting Detection
Tiki Wiki CMS Groupware 5.2 contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks...
Tiki Wiki CMS Groupware v25.0 - Cross Site Scripting Detection
Tiki Wiki CMS Groupware version 25.0 suffers from a cross site scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki CMS Groupware version 25.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...
Tiki Wiki CMS Groupware Login Panel - Detect
Tiki Wiki CMS Groupware login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki CMS Groupware login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tiki Wiki CMS Groupware...
Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting Detection
Tiki Wiki CMS Groupware 7.0 is vulnerable to cross-site scripting via the GET "ajax" parameter to snarfajax.php. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki CMS Groupware 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...
Tiki Wiki CMS Groupware 5.2 - Local File Inclusion Detection
Tiki Wiki CMS Groupware 5.2 is susceptible to a local file inclusion vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki CMS Groupware 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tiki Wiki CM...
TikiWiki CMS Groupware v8.3 - Open Redirect Detection
tiki-featuredlink.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection !/usr/bin/env python3 -- coding: utf-8 -- """tiki-featuredlink.""" import re from kittysploit import fr...
CVE-2026-45016
creationtimestamp| type| source ---|---|--- 2026-07-07 14:35:05+00:00| published-proof-of-concept| https://github.com/EGroupware/egroupware/security/advisories/GHSA-c8m7-r2jv-rw63...
📄 Horde Groupware IMP Webmail Path Traversal / Local File Inclusion
Horde Groupware's IMP Webmail solution contains a path traversal / local file inclusion vulnerability which could be exploited to escalate privileges or bypass authentication. This is patched in version 7.0.1. this is my first time sending to a mailing list so ive chosen something easy. here goes...
CVE-2026-46445
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection...
EUVD-2026-24254
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value logged as the "user" field without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted...
EUVD-2026-14269
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length only 12 digits instead of the 20 recommended...
