Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI.
{ "versions": [ { "introduced": "0" }, { "last_affected": "5.2.22" } ] }
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12094.json"