Vulnerabilities > Phpgroupware

DATE CVE VULNERABILITY TITLE RISK
2004-02-03 CVE-2004-0017 Module SQL Injection vulnerability in PHPgroupware 0.9.14
Multiple SQL injection vulnerabilities in the (1) calendar and (2) infolog modules for phpgroupware 0.9.14 allow remote attackers to perform unauthorized database operations.
network
low complexity
phpgroupware
7.5
2004-02-03 CVE-2004-0016 Unspecified vulnerability in PHPgroupware 0.9.14
The calendar module for phpgroupware 0.9.14 does not enforce the "save extension" feature for holiday files, which allows remote attackers to create and execute PHP files.
network
low complexity
phpgroupware
7.5
2003-08-27 CVE-2003-0657 SQL-Injection vulnerability in Phpgroupware
Multiple SQL injection vulnerabilities in the infolog module for phpgroupware 0.9.14 and earlier could allow remote attackers to conduct unauthorized database actions.
network
low complexity
phpgroupware
7.5
2003-08-27 CVE-2003-0599 Remote Security vulnerability in PHPgroupware 0.9.16Prerc
Unknown vulnerability in the Virtual File System (VFS) capability for phpGroupWare 0.9.16preRC and versions before 0.9.14.004 with unknown implications, related to the VFS path being under the web document root.
network
low complexity
phpgroupware
critical
10.0
2003-08-07 CVE-2003-0504 Cross-Site Scripting vulnerability in PHPgroupware 0.9.14.003
Multiple cross-site scripting (XSS) vulnerabilities in Phpgroupware 0.9.14.003 (aka webdistro) allow remote attackers to insert arbitrary HTML or web script, as demonstrated with a request to index.php in the addressbook module.
network
phpgroupware
4.3
2002-07-03 CVE-2002-0536 Unspecified vulnerability in PHPgroupware 0.9.13
PHPGroupware 0.9.12 and earlier, when running with the magic_quotes_gpc feature disabled, allows remote attackers to compromise the database via a SQL injection attack.
network
low complexity
phpgroupware
7.5
2001-02-16 CVE-2001-0043 Unspecified vulnerability in PHPgroupware 0.9.6
phpGroupWare before 0.9.7 allows remote attackers to execute arbitrary PHP commands by specifying a malicious include file in the phpgw_info parameter of the phpgw.inc.php program.
network
low complexity
phpgroupware
critical
10.0