CVE-2016-2228

Cross-site scripting (XSS) vulnerability in horde/templates/topbar/_menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter, as demonstrated by a request to xplorer/gollem/manager.php.

• CWE-79

• http://bugs.horde.org/ticket/14213
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html
• http://lists.horde.org/archives/announce/2016/001148.htmlVendor Advisory
• http://lists.horde.org/archives/announce/2016/001149.htmlVendor Advisory
• http://www.debian.org/security/2016/dsa-3497
• http://www.openwall.com/lists/oss-security/2016/02/06/4
• http://www.openwall.com/lists/oss-security/2016/02/06/5
• https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bundles/webmail/docs/CHANGES
• https://github.com/horde/horde/commit/ab07a1b447de34e13983b4d7ceb18b58c3a358d8Exploit
• http://bugs.horde.org/ticket/14213
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177484.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177584.html
• http://lists.horde.org/archives/announce/2016/001148.htmlVendor Advisory
• http://lists.horde.org/archives/announce/2016/001149.htmlVendor Advisory
• http://www.debian.org/security/2016/dsa-3497
• http://www.openwall.com/lists/oss-security/2016/02/06/4
• http://www.openwall.com/lists/oss-security/2016/02/06/5
• https://github.com/horde/horde/blob/e838d4c800b0d1ecaf8b4cc613fd3af4f994c79c/bundles/webmail/docs/CHANGES
• https://github.com/horde/horde/commit/ab07a1b447de34e13983b4d7ceb18b58c3a358d8Exploit

Published

Apr 13, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2219Cross-site scripting (XSS) vulnerability in the management i…
• CVE-2016-2221Open redirect vulnerability in the wp_validate_redirect func…
• CVE-2016-2222The wp_http_validate_url function in wp-includes/http.php in…
• CVE-2016-2224The __decode_dotted function in libc/inet/resolv.c in uClibc…
• CVE-2016-2225The __read_etc_hosts_r function in libc/inet/resolv.c in uCl…
• CVE-2016-2226Integer overflow in the string_appends function in cplus-dem…
• CVE-2016-2230OpenELEC and RasPlex devices have a hardcoded password for t…
• CVE-2016-2231The Windows-based Host Interface Program (WHIP) service on H…
• CVE-2016-2232Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 1…
• CVE-2016-2233Stack-based buffer overflow in the inbound_cap_ls function i…
• CVE-2016-2242Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attacker…
• CVE-2016-2243Sure Start on HP Commercial PCs 2015 allows local users to c…