CVE-2016-5303

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-12-20 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.

Affected products

Horde Groupware: 5.2.15

References

http://marc.info/?l=horde-announce&m=147319066126665&w=2
http://marc.info/?l=horde-announce&m=147319089526753&w=2
http://www.securityfocus.com/bid/94997
https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97
https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424
http://marc.info/?l=horde-announce&m=147319066126665&w=2
http://marc.info/?l=horde-announce&m=147319089526753&w=2
http://www.securityfocus.com/bid/94997
https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333b97
https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb424

Get alerted when CVE-2016-5303 or the next vulnerability affects your stack