CVE-2019-12094

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI.

• CWE-79

• https://bugs.horde.org/ticket/14926Exploit, Issue Tracking, Vendor Advisory
• https://cxsecurity.com/issue/WLB-2019050199Exploit, Third Party Advisory
• https://numanozdemir.com/respdisc/horde/horde.mp4Exploit, Third Party Advisory
• https://numanozdemir.com/respdisc/horde/horde.txtExploit, Third Party Advisory
• https://packetstormsecurity.com/files/152975/Horde-Webmail-5.2.22-XSS-CSRF-SQL-Injection-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46903Exploit, Third Party Advisory, VDB Entry
• https://bugs.horde.org/ticket/14926Exploit, Issue Tracking, Vendor Advisory
• https://cxsecurity.com/issue/WLB-2019050199Exploit, Third Party Advisory
• https://numanozdemir.com/respdisc/horde/horde.mp4Exploit, Third Party Advisory
• https://numanozdemir.com/respdisc/horde/horde.txtExploit, Third Party Advisory
• https://packetstormsecurity.com/files/152975/Horde-Webmail-5.2.22-XSS-CSRF-SQL-Injection-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46903Exploit, Third Party Advisory, VDB Entry

Published

Oct 24, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1208A remote code execution vulnerability exists in the way that…7.5
• CVE-2019-12083The Rust Programming Language Standard Library 1.34.x before…8.1
• CVE-2019-12086A Polymorphic Typing issue was discovered in FasterXML jacks…7.5
• CVE-2019-12087Samsung S9+, S10, and XCover 4 P(9.0) devices can become tem…
• CVE-2019-1209An information disclosure vulnerability exists in Lync 2013,…6.5
• CVE-2019-12091The Netskope client service, v57 before 57.2.0.219 and v60 b…7.8
• CVE-2019-12095Horde Trean, as used in Horde Groupware Webmail Edition thro…8.8
• CVE-2019-12097Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of …
• CVE-2019-12098In the client side of Heimdal before 7.6.0, failure to verif…7.4
• CVE-2019-12099In PHP-Fusion 9.03.00, edit_profile.php allows remote authen…
• CVE-2019-1210Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-12101coap_decode_option in coap.c in LibNyoci 0.07.00rc1 mishandl…