CVE-2012-6554: functions/html_to_text.php in the Chat module before 1.5.2 for activeCollab allows remote authenticated use...

Security readout for executives and security teams

This issue affects the activeCollab Chat module before 1.5.2. A logged-in user could abuse chat message handling to run PHP code on the server. That can turn an ordinary application account into server compromise if the vulnerable module is still deployed. Exposure is limited to organizations still running activeCollab with the Chat module before 1.5.2. The source bundle does not provide complete affected product metadata, CPEs, or deployment prevalence. Prioritize this where legacy activeCollab Chat is internet-accessible or broadly available to users. The business risk is server-side code execution by an authenticated user, but urgency depends on whether the old Chat module is still present. Mitigation focus: Upgrade the activeCollab Chat module to 1.5.2 or later if available.; Check the vendor release page for authoritative upgrade or replacement guidance.; Disable or restrict the Chat module until vulnerable instances are remediated..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.