Vulnerabilities > Phpgroupware > Phpgroupware
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2010-05-19 | CVE-2010-0404 | SQL Injection vulnerability in PHPgroupware Multiple SQL injection vulnerabilities in phpGroupWare (phpgw) before 0.9.16.016 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) class.sessions_db.inc.php, (2) class.translation_sql.inc.php, or (3) class.auth_sql.inc.php in phpgwapi/inc/. | 7.5 |
| 2010-05-19 | CVE-2010-0403 | Path Traversal vulnerability in PHPgroupware Directory traversal vulnerability in about.php in phpGroupWare (phpgw) before 0.9.16.016 allows remote attackers to include and execute arbitrary local files via a .. | 6.8 |
| 2009-12-24 | CVE-2009-4416 | Cross-Site Scripting vulnerability in PHPgroupware 0.9.16.12 Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw_" sequence. | 4.3 |
| 2009-12-24 | CVE-2009-4415 | Path Traversal vulnerability in PHPgroupware 0.9.16.12 Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to (1) read arbitrary files via the csvfile parameter to addressbook/csv_import.php, or (2) include and execute arbitrary local files via the conv_type parameter in addressbook/inc/class.uiXport.inc.php. | 7.5 |
| 2009-12-24 | CVE-2009-4414 | SQL Injection vulnerability in PHPgroupware 0.9.16.012 SQL injection vulnerability in phpgwapi /inc/class.auth_sql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the passwd parameter to login.php. | 6.8 |
| 2006-08-31 | CVE-2006-4458 | Local File Include vulnerability in PHPgroupware 0.9.16.010 Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allows remote attackers to include arbitrary local files via a .. | 6.4 |
| 2005-11-18 | CVE-2005-3347 | Path Traversal vulnerability in PHPgroupware 0.9.16 Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. | 6.8 |
| 2005-08-31 | CVE-2005-2761 | Unspecified vulnerability in PHPgroupware 0.9.16.000 Cross-site scripting (XSS) vulnerability in phpGroupWare 0.9.16.000 allows administrators to inject arbitrary web script or HTML by modifying the main screen message. network phpgroupware | 4.3 |
| 2004-12-31 | CVE-2004-2578 | Information Disclosure vulnerability in PHPGroupWare Plaintext Cookie Authentication Credentials phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords. | 5.0 |
| 2004-12-31 | CVE-2004-2577 | Unspecified vulnerability in PHPgroupware 0.9.16Rc1/0.9.16Rc2 The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts. | 5.0 |