CVE-2007-1473: horde horde_application_framework
Vulnerability summary
CVE-2007-1473 is a medium (CVSS 4.3) vulnerability in horde horde_application_framework. EPSS estimates a 5.32% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 16-03-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selection box, allows remote attackers to inject arbitrary web script or HTML via the new_lang parameter to login.php.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
5.32%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
+0.16 pp
From 5.15% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundHorde Framework 3.1.3 - 'login.php' Cross-Site Scripting
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Horde1 product
- horde_application_framework1.2.0 | 1.2.1 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.5 | 1.2.6 | 1.2.7 | 1.2.8 | 1.3.3 | 1.3.4 | 2.0 | 2.1 | 2.2 | 2.2.1 | 2.2.3 | 2.2.4 | 2.2.5 | 2.2.6 | 2.2.7 | 2.2.8 | 2.2.9 | 3.0.0 | 3.0.1 | 3.0.2 | 3.0.3 | 3.0.4 | 3.0.5 | 3.0.6 | 3.0.7 | 3.0.8 | 3.0.9 | 3.0.10 | 3.1.0 | 3.1.1 | 3.1.2 | 3.1.3
1 vendor · 1 product
