CVE-2023-38329: Egroupware

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthenticated remote attackers to inject arbitrary web script or HTML into the "user" HTTP/GET parameter, which reflects its input without sanitization.

Affected products

• Egroupware Egroupware: version 17.1.20190111 only

Published 2025-07-11. Last modified 2026-06-17.