CVE-2012-6640: Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Hor...

Security readout for executives and security teams

This is an old cross-site scripting issue in Horde IMP webmail. A malicious SVG image attachment could cause script or HTML to run in a user's browser. The sources identify fixed releases but do not provide CVSS scoring or evidence of active exploitation. Exposure is most likely in legacy Horde IMP or Horde Groupware Webmail Edition installations that still allow users to receive or view SVG attachments through webmail. Current exposure cannot be inferred from the sources without asset inventory. Treat this as a legacy exposure cleanup item unless affected webmail is still externally reachable. If vulnerable Horde versions remain in use, prioritize upgrade or isolation because webmail compromise can directly affect user trust and mailbox confidentiality. Mitigation focus: Upgrade Horde IMP to 5.0.22 or later where applicable.; Upgrade Horde Groupware Webmail Edition to 4.0.9 or later where applicable.; Check Horde release notes and vendor guidance before applying interim controls..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.