CVE-2005-4190
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8...
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.
- Record
CVE-2005-4190- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.
- Record
CVE-2005-4190- Updated
- 2026-11-02
EUVDEUVD-2005-4185 No score
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.
- Record
EUVD-2005-4185- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-22x4-mg72-m2h8 No score
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8...
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.
- Record
GHSA-22x4-mg72-m2h8- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
horde3Debian:3.1 From an advisory covering 3 CVEs |
before 3.0.4-4sarge3, plus listed versions 3.0.4-43.0.4-4sarge13.0.4-4sarge2 |
3.0.4-4sarge3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-4190 is a low vulnerability (CVSS 3.5) in Horde Application Framework, published December 13, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. No source names a fixed version.
References
securityfocus.com/bid/15810
vupen.com/english/advisories/2005/2835
Show 12 moreShow less
secunia.com/advisories/19619
debian.org/security/2006/dsa-1033
novell.com/linux/security/advisories/2006_16_sr.html
sec-consult.com/245.html
lists.horde.org/archives/announce/2005/000238.html
nvd.nist.gov/vuln/detail/CVE-2005-4190
github.com/advisories/GHSA-22x4-mg72-m2h8