EGroupware

Records26All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

EGroupware records in CISA KEV

No EGroupware vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Egroupware 24 records HIGH Egroupware Enterprise Line 4 records LOW

Records

26 records

TI-2024-27031 CVE-2024-40614 · GHSA-phg7-8mm9-gj88

EGroupware before 23.1.20240624 mishandles an ORDER BY clause.

HIGH 76

EGroupware before 23.1.20240624 mishandles an ORDER BY clause.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00678 Published 2024-07-07 Fixed in 23.1.20240624 CWE-89

TI-2026-17853 CVE-2026-22243 · GHSA-rvxj-7f72-mhrx

EGroupware has SQL Injection in Nextmatch Filter Processing

HIGH 73

EGroupware is a Web based groupware server written in PHP.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00428 Published 2026-01-28 Fixed in 23.1.20260113, 26.0.20260113 CWE-89

TI-2026-29001 CVE-2026-40187 · GHSA-8737-2x9g-xjj7

Authenticated RCE via Malicious eTemplate Upload in EGroupware

HIGH 72

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00857 Published 2026-07-20 Fixed in 26.4.20260413, 23.1.20260601 CWE-78

TI-2026-22175 CVE-2026-27823 · GHSA-h9qx-v5xp-ph8p

Remote Code Execution Vulnerability in EGroupware

MEDIUM 48

A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE).

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00975 Published 2026-07-20 Fixed in 26.2.20260224, 23.1.20260224 CWE-285

TI-2007-03051 CVE-2007-3154 · GHSA-jv45-xgw6-mfrv

Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as…

MEDIUM 47

Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packages, has unknown impact and remote attack vectors.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.01867 Published 2007-06-11 No fix listed

TI-2008-01961 CVE-2008-2041 · GHSA-jxmj-hvhx-v9x5

Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack…

MEDIUM 46

Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web server has write access to a directory under the web document root.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.01633 Published 2008-04-30 No fix listed CWE-94

TI-2007-03052 CVE-2007-3155 · GHSA-3jv6-9q5f-rc7v

Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack…

MEDIUM 46

Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack vectors related to ADOdb.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.01808 Published 2007-06-11 No fix listed

TI-2010-03166 CVE-2010-3313 · GHSA-5gx6-f2qq-475f

phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchec…

MEDIUM 44

phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.08501 Published 2010-09-22 Fixed in 1.6.003, 9.1.20100309 +1 CWE-94

TI-2014-02389 CVE-2014-2988 · GHSA-w28c-prr6-33rc

EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before…

MEDIUM 41

EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via cra…

CVSS 2.0HIGH 8.5 Network Low privileges Interaction — EPSS 0.0184 Published 2014-10-27 No fix listed CWE-94

TI-2014-01591 CVE-2014-2027 · GHSA-wjvf-c62h-746v

eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object…

MEDIUM 40

eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressboo…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04129 Published 2015-03-31 No fix listed CWE-94

TI-2005-01141 CVE-2005-1203 · GHSA-g4pc-pvx5-3ggf

Multiple SQL injection vulnerabilities in index.php in eGroupware before 1.0.0.007 allow…

LOW 39

Multiple SQL injection vulnerabilities in index.php in eGroupware before 1.0.0.007 allow remote attackers to execute arbitrary SQL commands via the (1) filter or (2) cats_app parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03202 Published 2005-04-21 No fix listed

TI-2011-04259 CVE-2011-4949 · GHSA-79p4-4hmr-m547

SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php in…

LOW 36

SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote atta…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01522 Published 2012-08-31 No fix listed CWE-89

TI-2005-01140 CVE-2005-1202 · GHSA-2g48-mphv-rw7c

Multiple cross-site scripting (XSS) vulnerabilities in eGroupware before 1.0.0.007 allow…

LOW 35

Multiple cross-site scripting (XSS) vulnerabilities in eGroupware before 1.0.0.007 allow remote attackers to inject arbitrary web script or HTML via the (1) ab_id, (2) page, (3) type, or (4) lang parameter to index.php o…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02975 Published 2005-04-21 No fix listed

TI-2014-02388 CVE-2014-2987 · GHSA-2wjg-893f-qh7w

Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line…

LOW 33

Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allow remote attac…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01364 Published 2014-10-26 No fix listed CWE-352

TI-2008-01439 CVE-2008-1502 · GHSA-v759-3wr5-p294

The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in…

LOW 33

The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cros…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.10503 Published 2008-03-25 Fixed in 1.8.5 CWE-79

TI-2023-19724 CVE-2023-38327 · GHSA-vp7c-j92g-63ff

An issue was discovered in eGroupWare 17.1.20190111.

LOW 30

An issue was discovered in eGroupWare 17.1.20190111.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00354 Published 2025-07-11 No fix listed CWE-203

TI-2017-10944 CVE-2017-14920 · GHSA-qfg7-wc25-r3j2

Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an…

LOW 29

Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the app…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01119 Published 2017-09-29 Fixed in 16.1.20170922 CWE-79

TI-2011-04261 CVE-2011-4951 · GHSA-j4qw-pvqf-gjwc

Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line…

LOW 29

Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to redirect users to arbi…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01491 Published 2012-08-31 No fix listed

TI-2023-19726 CVE-2023-38329 · GHSA-xcph-hqh8-mmw7

An issue was discovered in eGroupWare 17.1.20190111.

LOW 27

An issue was discovered in eGroupWare 17.1.20190111.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00279 Published 2025-07-11 No fix listed CWE-79

TI-2011-04258 CVE-2011-4948 · GHSA-x97j-x6m9-jfh7

Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line (EPL)…

LOW 27

Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to read arbitrary files vi…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02263 Published 2012-08-31 No fix listed CWE-22

TI-2010-03167 CVE-2010-3314 · GHSA-4rjc-mr4g-cqp6

Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002…

LOW 26

Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attack…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03333 Published 2010-09-22 No fix listed CWE-79

TI-2004-01344 CVE-2004-1467 · GHSA-3j62-38ch-w2hh

Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.0.00.003 and earlier…

LOW 26

Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.0.00.003 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) date or search text field in the calendar module, (2) Field p…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0362 Published 2005-02-13 No fix listed

TI-2023-19725 CVE-2023-38328 · GHSA-jpq4-mchv-jv8r

An issue was discovered in eGroupWare 17.1.20190111.

LOW 24

An issue was discovered in eGroupWare 17.1.20190111.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00774 Published 2023-10-26 No fix listed CWE-522

TI-2012-01976 CVE-2012-2211 · GHSA-6xrh-8gj2-m92q

Cross-site scripting (XSS) vulnerability in phpgwapi/inc/common_functions_inc.php in…

LOW 23

Cross-site scripting (XSS) vulnerability in phpgwapi/inc/common_functions_inc.php in eGroupware before 1.8.004.20120405 allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to etemp…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01233 Published 2012-11-22 No fix listed CWE-79

TI-2011-04260 CVE-2011-4950 · GHSA-3m23-jj5c-7p7p

Cross-site scripting (XSS) vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware…

LOW 23

Cross-site scripting (XSS) vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to i…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01411 Published 2012-08-31 No fix listed CWE-79

Open these records in search →