CVE-2011-4950

Cross-site scripting (XSS) vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

• CWE-79

• http://comments.gmane.org/gmane.comp.web.egroupware.german/33144
• http://packetstormsecurity.org/files/100180/eGroupware-1.8.001-Cross-Site-Scripting.htmlExploit
• http://www.autosectools.com/Advisory/eGroupware-1.8.001-Reflected-Cross-site-Scripting-178Exploit
• http://www.egroupware.org/changelogVendor Advisory
• http://www.egroupware.org/epl-changelogVendor Advisory
• http://www.openwall.com/lists/oss-security/2012/03/29/1
• http://www.openwall.com/lists/oss-security/2012/03/30/3
• http://www.securityfocus.com/bid/52770
• http://comments.gmane.org/gmane.comp.web.egroupware.german/33144
• http://packetstormsecurity.org/files/100180/eGroupware-1.8.001-Cross-Site-Scripting.htmlExploit
• http://www.autosectools.com/Advisory/eGroupware-1.8.001-Reflected-Cross-site-Scripting-178Exploit
• http://www.egroupware.org/changelogVendor Advisory
• http://www.egroupware.org/epl-changelogVendor Advisory
• http://www.openwall.com/lists/oss-security/2012/03/29/1
• http://www.openwall.com/lists/oss-security/2012/03/30/3
• http://www.securityfocus.com/bid/52770

Published

Aug 31, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-4944Python 2.6 through 3.2 creates ~/.pypirc with world-readable…
• CVE-2011-4945PolicyKit 0.103 sets the AdminIdentities to "wheel" by defau…
• CVE-2011-4946SQL injection vulnerability in e107_admin/users_extended.php…
• CVE-2011-4947Cross-site request forgery (CSRF) vulnerability in e107_admi…
• CVE-2011-4948Directory traversal vulnerability in admin/remote.php in EGr…
• CVE-2011-4949SQL injection vulnerability in phpgwapi/js/dhtmlxtree/sample…
• CVE-2011-4951Open redirect vulnerability in phpgwapi/ntlm/index.php in EG…
• CVE-2011-4952cobbler: Web interface lacks CSRF protection when using Djan…8.8
• CVE-2011-4953The set_mgmt_parameters function in item.py in cobbler befor…
• CVE-2011-4954cobbler has local privilege escalation via the use of insecu…7.8
• CVE-2011-4955Multiple cross-site scripting (XSS) vulnerabilities in ui_st…
• CVE-2011-4956Cross-site scripting (XSS) vulnerability in WordPress before…