CVE-2015-8807

Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.

• CWE-79

• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html
• http://lists.horde.org/archives/announce/2016/001148.htmlVendor Advisory
• http://lists.horde.org/archives/announce/2016/001149.htmlVendor Advisory
• http://www.debian.org/security/2016/dsa-3496
• http://www.openwall.com/lists/oss-security/2016/02/06/4
• http://www.openwall.com/lists/oss-security/2016/02/06/5
• https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bundles/webmail/docs/CHANGESExploit
• https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html
• http://lists.horde.org/archives/announce/2016/001148.htmlVendor Advisory
• http://lists.horde.org/archives/announce/2016/001149.htmlVendor Advisory
• http://www.debian.org/security/2016/dsa-3496
• http://www.openwall.com/lists/oss-security/2016/02/06/4
• http://www.openwall.com/lists/oss-security/2016/02/06/5
• https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bundles/webmail/docs/CHANGESExploit
• https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253

Published

Apr 13, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8801Race condition in the client in Symantec Endpoint Protection…
• CVE-2015-8802Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-8803The ecc_256_modp function in ecc-256.c in Nettle before 3.2 …
• CVE-2015-8804x86_64/ecc-384-modp.asm in Nettle before 3.2 does not proper…
• CVE-2015-8805The ecc_256_modq function in ecc-256.c in Nettle before 3.2 …
• CVE-2015-8806dict.c in libxml2 allows remote attackers to cause a denial …7.5
• CVE-2015-8808The DecodeImage function in coders/gif.c in GraphicsMagick 1…
• CVE-2015-8812drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel be…9.8
• CVE-2015-8813The Page_Load function in Umbraco.Web/umbraco.presentation/u…
• CVE-2015-8814Umbraco before 7.4.0 allows remote attackers to bypass anti-…
• CVE-2015-8815Multiple cross-site scripting (XSS) vulnerabilities in Umbra…
• CVE-2015-8816The hub_activate function in drivers/usb/core/hub.c in the L…6.8