Cross-Site Scripting Vulnerability in Horde Groupware by Horde
CVE-2016-5303

6.1MEDIUM

Key Information:

Vendor: Horde
Status: Groupware
Vendor: CVE Published:; 20 December 2016

What is CVE-2016-5303?

A cross-site scripting (XSS) vulnerability exists in the Horde Text Filter API within Horde Groupware and Horde Groupware Webmail Edition versions prior to 5.2.16. This security flaw allows remote attackers to exploit the system by injecting arbitrary web scripts or HTML code through specially crafted 'data:text/html' content, specifically taking advantage of form action and xlink attributes. Proper validation and filtering mechanisms are essential to mitigate this risk.