CVE-2004-0016

CVE-2004-0016 describes a critical vulnerability in the calendar module of phpgroupware version 0.9.14, where the "save extension" feature for holiday files is not properly enforced. This flaw allows unauthenticated remote attackers to upload and execute arbitrary PHP files on the affected system. With a CVSS score of 7.5, it carries a high severity, enabling complete compromise of confidentiality, integrity, and availability with low attack complexity. While there is no evidence of active exploitation in the wild (KEV: No) and no public exploit code (Metasploit, Nuclei, ExploitDB: None), the vulnerability has garnered significant community discussion, indicating awareness among security researchers.