CVE-2024-40614: Egroupware

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.

Affected products

• Egroupware Egroupware: before 23.1.20240624 (fixed in 23.1.20240624)

Published 2024-07-07. Last modified 2026-06-17.