CVE-2012-0209

Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed...

7.5 HighPublic exploit

Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers to execute arbitrary PHP code.

Exploit likelihood

71.9%Down 7.6 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2012-0209
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-0209
Updated: 2026-11-02

EUVDEUVD-2012-0247 No score

Record: EUVD-2012-0247
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gr4h-894q-p7jp No score

Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed...

Record: GHSA-gr4h-894q-p7jp
Weakness: CWE-94
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Horde 3.3.12 - Backdoor Arbitrary PHP Code Execution (Metasploit)	2012-02-17
Metasploit	Horde 3.3.12 Backdoor Arbitrary PHP Code Execution	2012-02-13

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-0209 is a high vulnerability (CVSS 7.5) in Horde Groupware, published September 25, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 71.9%, the 99th percentile. No source names a fixed version.