CVE-2004-0016: Phpgroupware

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

The calendar module for phpgroupware 0.9.14 does not enforce the "save extension" feature for holiday files, which allows remote attackers to create and execute PHP files.

Affected products

• Phpgroupware Phpgroupware: version 0.9.14 only

Published 2004-02-03. Last modified 2026-06-16.