Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.0.00.003 and earlier…
Priority LOW 26Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.0.00.003 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) date or search text field in the calendar module, (2) Field parameter, Filter parameter, QField parameter, Start parameter or Search field in the address module, (3) Subject field in the message module or (4) Subject field in the Ticket module.
Why it matters now
EPSS 0.0362 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:egroupware:egroupware:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | EGroupware |
| cpe:2.3:a:egroupware:egroupware:1.0.1:*:*:*:*:*:*:* | 1.0.1 | Vulnerable | EGroupware |
| cpe:2.3:a:egroupware:egroupware:1.0.3:*:*:*:*:*:*:* | 1.0.3 | Vulnerable | EGroupware |
- cpe:2.3:a:egroupware:egroupware:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·EGroupware
- cpe:2.3:a:egroupware:egroupware:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·EGroupware
- cpe:2.3:a:egroupware:egroupware:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·EGroupware
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2004-1467
- 2026-10-03 Alias added: GHSA-3j62-38ch-w2hh
References
More Egroupware vulnerabilities
- TI-2024-27031 EGroupware before 23.1.20240624 mishandles an ORDER BY clause. CVSS 3.1CRITICAL 9.8
- TI-2026-17853 EGroupware has SQL Injection in Nextmatch Filter Processing CVSS 4.0HIGH 8.7
- TI-2007-03051 Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as… CVSS 2.0HIGH 10.0
- TI-2008-01961 Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack… CVSS 2.0HIGH 10.0
- TI-2007-03052 Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack… CVSS 2.0HIGH 10.0
- TI-2010-03166 phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchec… CVSS 2.0HIGH 7.5
Sources
- CVE-2004-1467 · CVE Program
- CVE-2004-1467 · NVD
- FIRST EPSS
- GHSA-3j62-38ch-w2hh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences