CVE-2006-3548
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through...
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).
- Record
CVE-2006-3548- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).
- Record
CVE-2006-3548- Updated
- 2026-11-02
EUVDEUVD-2006-3543 No score
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).
- Record
EUVD-2006-3543- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7396-36f7-76hx No score
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through...
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).
- Record
GHSA-7396-36f7-76hx- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
horde3Debian:3.1 From an advisory covering 5 CVEs |
before 3.0.4-4sarge6, plus listed versions 3.0.4-43.0.4-4sarge13.0.4-4sarge23.0.4-4sarge33.0.4-4sarge43.0.4-4sarge5 |
3.0.4-4sarge6 |
horde3Debian:4.0 From an advisory covering 5 CVEs |
before 3.1.3-4etch1, plus listed versions 3.1.3-4 |
3.1.3-4etch1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3548 is a medium vulnerability (CVSS 4.3) in Horde, published July 13, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. No source names a fixed version.
References
lists.grok.org.uk/pipermail/full-disclosure/2006-July/047687.html
exchange.xforce.ibmcloud.com/vulnerabilities/27589
lists.horde.org/archives/announce/2006/000287.html
securityfocus.com/bid/18845
vupen.com/english/advisories/2006/2694
secunia.com/advisories/21459
Show 11 moreShow less
novell.com/linux/security/advisories/2006_19_sr.html
securitytracker.com/id?1016442
securityreason.com/securityalert/1229
moritz-naumann.com/adv/0011/hordemulti/0011.txt
debian.org/security/2007/dsa-1406
nvd.nist.gov/vuln/detail/CVE-2006-3548
github.com/advisories/GHSA-7396-36f7-76hx