CVE-2004-0016

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The calendar module for phpgroupware 0.9.14 does not enforce the "save extension" feature for holiday files, which allows remote attackers to create and execute PHP files.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2004/dsa-419Patch, Vendor Advisory
http://www.osvdb.org/6860
http://www.securityfocus.com/bid/9387Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13489
http://www.debian.org/security/2004/dsa-419Patch, Vendor Advisory
http://www.osvdb.org/6860
http://www.securityfocus.com/bid/9387Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13489

Timeline

Published: Feb 3, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-00177.5Multiple SQL injection vulnerabilities in the (1) calendar and (2) infolog modules for phpgroupware 0.9.14 allow remote attackers to perform CVE-2004-00287.5jitterbug 1.6.2 does not properly sanitize inputs, which allows remote authenticated users to execute arbitrary commands.CVE-2004-00294.6Lotus Notes Domino 6.0.2 on Linux installs the notes.ini configuration file with world-writable permissions, which allows local users to mod CVE-2004-00309.8PHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and (3) config_gedcom.php for PHPGEDVIEW 2.61 al CVE-2004-00317.5PHPGEDVIEW 2.61 allows remote attackers to reinstall the software and change the administrator password via a direct HTTP request to editcon CVE-2004-00326.8Cross-site scripting (XSS) vulnerability in search.php in PHPGEDVIEW 2.61 allows remote attackers to inject arbitrary HTML and web script vi CVE-2004-00335.0admin.php in PHPGEDVIEW 2.61 allows remote attackers to obtain sensitive information via an action parameter with a phpinfo command.CVE-2004-00344.3Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web scrip CVE-2004-00357.5SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the h CVE-2004-00365.0SQL injection vulnerability in calendar.php for vBulletin Forum 2.3.x before 2.3.4 allows remote attackers to steal sensitive information vi CVE-2004-00377.5FirstClass Desktop Client 7.1 allows remote attackers to execute arbitrary commands via hyperlinks in FirstClass RTF messages.CVE-2004-00387.5McAfee ePolicy Orchestrator (ePO) 2.5.1 Patch 13 and 3.0 SP2a Patch 3 allows remote attackers to execute arbitrary commands via certain HTTP