Multiple cross-site scripting (XSS) vulnerabilities in Phpgroupware (aka webdistro) 0.9.16.002 and earlier allow remote attackers to insert arbitrary HTML or web script, as demonstrated with a request to the wiki module.
| Software | From | Fixed in |
|---|---|---|
| phpgroupware / phpgroupware | 0.9.12 | 0.9.12.x |
| phpgroupware / phpgroupware | 0.9.13 | 0.9.13.x |
| phpgroupware / phpgroupware | 0.9.14.003 | 0.9.14.003.x |
| phpgroupware / phpgroupware | 0.9.14.005 | 0.9.14.005.x |
| phpgroupware / phpgroupware | 0.9.14.006 | 0.9.14.006.x |
| phpgroupware / phpgroupware | 0.9.14.007 | 0.9.14.007.x |
| phpgroupware / phpgroupware | 0.9.16_rc1 | 0.9.16_rc1.x |
| phpgroupware / phpgroupware | 0.9.16.000 | 0.9.16.000.x |
| phpgroupware / phpgroupware | 0.9.16.002 | 0.9.16.002.x |