Início / CVEs
Vulnerabilidades exploradas (CISA KEV)
CVEs com exploração confirmada pela CISA (Known Exploited Vulnerabilities), com ação exigida e prazos.
CVE-2025-68461
Média · 6.1
KEV Alta · 62 Exploit público CWE-79 18/12/2025
RoundCube Webmail Cross-site Scripting Vulnerability
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVE-2025-49113
Alta · 8.8
KEV Urgente · 76 Exploit público CWE-502 02/06/2025
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
CVE-2024-42009
Crítica · 9.3
KEV Urgente · 70 Exploit público CWE-79 05/08/2024
RoundCube Webmail Cross-Site Scripting Vulnerability
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
CVE-2024-37383
Média · 6.1
KEV Alta · 67 Exploit público CWE-79 07/06/2024
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
CVE-2023-5631
Média · 5.4
KEV Alta · 53 CWE-79 18/10/2023
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker
to load arbitrary JavaScript code.
CVE-2023-43770
Média · 6.1
KEV Alta · 59 Exploit público CWE-79 22/09/2023
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
CVE-2021-44026
Crítica · 9.8
KEV Alta · 69 Exploit público CWE-89 19/11/2021
Roundcube Webmail SQL Injection Vulnerability
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
CVE-2020-35730
Média · 6.1
KEV Alta · 59 Exploit público CWE-79 28/12/2020
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
CVE-2020-13965
Média · 6.1
KEV Alta · 59 Exploit público CWE-79 09/06/2020
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
CVE-2020-12641
Crítica · 9.8
KEV Urgente · 73 Exploit público CWE-78 04/05/2020
Roundcube Webmail Remote Code Execution Vulnerability
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
CVE-2017-16651
Alta · 7.8
KEV Urgente · 74 Exploit público CWE-552 09/11/2017
Roundcube Webmail File Disclosure Vulnerability
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.