Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2006-1491 — Code Injection in Application Framework

CWE-94 — Code Injection3 documents3 sources
Severity
7.5HIGHNVD
EPSS
18.3%
top 4.77%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Horde Application Framework
Timeline
PublishedMar 29
Latest updateMay 1

Description

Eval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execute arbitrary code via the help viewer.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDhorde/application_framework12 versions+11

Patches

Patch: lists.horde.org ↗Patch: securitytracker.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-3r53-83gh-9p5m: Eval injection vulnerability in Horde Application Framework versions 3↗2022-05-01
▶

💥Exploits & PoCs

1
Exploit-DB
Horde 3.0.9/3.1.0 - Help Viewer Remote Code Execution (Metasploit)↗2006-04-10
▶