Login Request a demo
Unscored severity · published Dec 8, 2005
CVE-2005-4080
Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imp · Horde
2.0; 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +19 more · source: NVD
Affected product
IM
Imp
Horde
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4080
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4080
secunia.com
http://secunia.com/advisories/17910
securityreason.com
http://securityreason.com/securityalert/232
securitytracker.com
http://securitytracker.com/id?1015315
www.securityfocus.com
http://www.securityfocus.com/archive/1/418734/100/0/threaded
Exploit
http://www.securityfocus.com/bid/15730/
www.vupen.com
http://www.vupen.com/english/advisories/2005/2773
More from Imp
7.2
CVE-2025-30349
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror…
6.5
CVE-2026-58451
Horde IMP < 7.0.1 Path Traversal via Compose.php img src
6.1
CVE-2026-65053
Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
5.3
CVE-2002-2024
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4)…
–
CVE-2012-6640
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to…