CVE-2012-0209: Horde Groupware

High severity, CVSS 7.5. EPSS: 71.9% chance of exploitation in the next 30 days.

Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers to execute arbitrary PHP code.

Affected products

• Horde Groupware: version 1.2.10 only
• Horde Horde: version 3.3.12 only

Published 2012-09-25. Last modified 2026-06-16.