Login Request a demo
Unscored severity · published Mar 20, 2007
CVE-2007-1515
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imp · Horde
through 4.1.3 · source: NVD
Affected product
IM
Imp
Horde
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1515
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1515
Exploit
http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052977.html
Patch
http://lists.horde.org/archives/announce/2007/000316.html
secunia.com
http://secunia.com/advisories/24541
www.securityfocus.com
http://www.securityfocus.com/archive/1/462914/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/22975
www.securitytracker.com
http://www.securitytracker.com/id?1017774
More from Imp
7.2
CVE-2025-30349
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror…
6.5
CVE-2026-58451
Horde IMP < 7.0.1 Path Traversal via Compose.php img src
6.1
CVE-2026-65053
Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
5.3
CVE-2002-2024
Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4)…
–
CVE-2012-6640
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to…