Exploited vulnerabilities (CISA KEV)

CVE-2025-68461 Medium · 6.1 KEV High · 62 Public exploit CWE-79 Dec 18, 2025

RoundCube Webmail Cross-site Scripting Vulnerability

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

CVE-2025-49113 High · 8.8 KEV Urgent · 76 Public exploit CWE-502 Jun 2, 2025

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

CVE-2024-42009 Critical · 9.3 KEV Urgent · 70 Public exploit CWE-79 Aug 5, 2024

RoundCube Webmail Cross-Site Scripting Vulnerability

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

CVE-2024-37383 Medium · 6.1 KEV High · 67 Public exploit CWE-79 Jun 7, 2024

RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

CVE-2023-5631 Medium · 5.4 KEV High · 53 CWE-79 Oct 18, 2023

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

CVE-2023-43770 Medium · 6.1 KEV High · 59 Public exploit CWE-79 Sep 22, 2023

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

CVE-2021-44026 Critical · 9.8 KEV High · 69 Public exploit CWE-89 Nov 19, 2021

Roundcube Webmail SQL Injection Vulnerability

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

CVE-2020-35730 Medium · 6.1 KEV High · 59 Public exploit CWE-79 Dec 28, 2020

Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

CVE-2020-13965 Medium · 6.1 KEV High · 59 Public exploit CWE-79 Jun 9, 2020

Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

CVE-2020-12641 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-78 May 4, 2020

Roundcube Webmail Remote Code Execution Vulnerability

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

CVE-2017-16651 High · 7.8 KEV Urgent · 74 Public exploit CWE-552 Nov 9, 2017

Roundcube Webmail File Disclosure Vulnerability

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.