CVE-2014-1691: Horde Application Framework

High severity, CVSS 7.5. EPSS: 42.9% chance of exploitation in the next 30 days.

The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.

Affected products

• Horde Horde Application Framework: up to and including 5.1.0; version 5.0.0 only; version 5.0.1 only; version 5.0.2 only; version 5.0.3 only; version 5.0.4 only

Published 2014-04-01. Last modified 2026-06-17.