CVE-2005-1202: egroupware

EPSS trend

Probability

2.97%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

0.00 pp

From 2.97% on 20-09-2026

20-09-202620-10-2026

EPSS score

2.97%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasephpVerified
eGroupWare 1.0 - '/sitemgr-site/index.php?category_id' Cross-Site Scripting
Maturity: poc
exploit-databasephpVerified
eGroupWare 1.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Maturity: poc

References

7 links

sourceforge.net/project/shownotes.php?release_id=320768X Refsource CONFIRMPatch
www.osvdb.org/15751VDB EntryX Refsource OSVDB
www.securityfocus.com/bid/13212VDB EntryX Refsource BIDExploitPatch
www.gulftech.org?node=research&article_id=00069-04202005X Refsource MISC
security.gentoo.org/glsa/glsa-200504-24.xmlVendor AdvisoryX Refsource GENTOOPatch
marc.info?l=bugtraq&m=111401760125555&w=2Mailing ListX Refsource BUGTRAQ
secunia.com/advisories/14982Third Party AdvisoryX Refsource SECUNIA

Related vulnerabilities

CVE-2007-5091egroupwareegroupware1.09%19y ago26-09-2007 20:00Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.4.001 allow remote attackers to inject arbitrary web script or HTML via the cat_data[color] parameter to (1) preferences/inc/class.uicategories.inc.php and (2) admin/inc/class.uicategories.inc.php.CVE-2007-3155egroupwareegroupware1.81%19y ago11-06-2007 22:00Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack vectors related to ADOdb. NOTE: due to lack of details from the vendor, it is uncertain whether this issue is already covered by another CVE identifier.CVE-2007-3154egroupwareegroupware1.87%19y ago11-06-2007 22:00Unspecified vulnerability in Walter Zorn wz_tooltip.js (aka wz_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packages, has unknown impact and remote attack vectors.CVE-2014-2987egroupwareegroupware1.36%11y ago26-10-2014 18:00Multiple cross-site request forgery (CSRF) vulnerabilities in EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator user via an admin.uiaccounts.add_user action to index.php or (2) modify settings via the newsettings parameter in an admin.uiconfig.index action to index.php. NOTE: vector 2 can be used to execute arbitrary PHP code by leveraging CVE-2014-2988.CVE-2014-2988egroupwareegroupware1.84%11y ago27-10-2014 01:00EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.CVE-2014-2027egroupwareegroupware+24.13%11y ago31-03-2015 14:00eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.php, (5) info_fields or (6) trans parameter to csv_import.php in (a) projectmanager/ or (b) infolog/, or (7) processed parameter to preferences/inc/class.uiaclprefs.inc.php.

All vulnerabilities inegroupware

CVE-2005-1202: egroupware

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References