CVE-2010-3695: Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupwa...

Security readout for executives and security teams

CVE-2010-3695 is a cross-site scripting issue in legacy Horde webmail. If an organization still runs affected versions, an attacker could inject script into a webmail workflow and potentially act within a victim’s browser session. Sources name fixed releases, but provide no evidence of current active exploitation. Exposure is likely limited to organizations still operating Horde IMP 4.3.7 or earlier, or Horde Groupware Webmail Edition before 1.2.7. Internet-facing webmail raises business risk because user sessions and mailbox access are involved. Prioritize remediation if legacy Horde webmail is internet-facing or used for sensitive mailboxes. This is not evidenced as actively exploited in the bundle, but XSS in webmail can create meaningful account and data exposure. Mitigation focus: Upgrade Horde IMP to 4.3.8 or later.; Upgrade Horde Groupware Webmail Edition to 1.2.7 or later.; Apply relevant distribution security updates, including Debian guidance where applicable..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.