CVE-2007-1515

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information.

• http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.htmlExploit, Vendor Advisory
• http://lists.horde.org/archives/announce/2007/000316.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/24541
• http://www.securityfocus.com/archive/1/462914/100/0/threaded
• http://www.securityfocus.com/bid/22975
• http://www.securitytracker.com/id?1017774
• http://www.vupen.com/english/advisories/2007/0964
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.htmlExploit, Vendor Advisory
• http://lists.horde.org/archives/announce/2007/000316.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/24541
• http://www.securityfocus.com/archive/1/462914/100/0/threaded
• http://www.securityfocus.com/bid/22975
• http://www.securitytracker.com/id?1017774
• http://www.vupen.com/english/advisories/2007/0964

Published

Mar 20, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1509Directory traversal vulnerability in enkrypt.php in Sascha S…
• CVE-2007-1510SQL injection vulnerability in post.php in Particle Blogger …
• CVE-2007-1511Buffer overflow in FrontBase Relational Database Server 4.2.…
• CVE-2007-1512Stack-based buffer overflow in the AfxOleSetEditMenu functio…
• CVE-2007-1513PHP remote file inclusion vulnerability in comanda.php in Gr…
• CVE-2007-1514PHP remote file inclusion vulnerability in index.php in Vipe…
• CVE-2007-1516PHP remote file inclusion vulnerability in functions/update.…
• CVE-2007-1517SQL injection vulnerability in comments.php in WSN Guest 1.0…
• CVE-2007-1518SQL injection vulnerability in usergroups.php in Woltlab Bur…
• CVE-2007-1519Cross-site scripting (XSS) vulnerability in modules.php in P…
• CVE-2007-1520The cross-site request forgery (CSRF) protection in PHP-Nuke…
• CVE-2007-1521Double free vulnerability in PHP before 4.4.7, and 5.x befor…