Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

CVE-2020-13965

🗓️ 09 Jun 2020 02:45:24Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov👁 230 Views🌐 WEB

An XSS vulnerability in Roundcube Webmail allows remote attackers to execute malicious code via a crafted XML attachment

Related
Detection
Refs
Paths
ReporterTitlePublishedViews
Family
ATTACKERKB		CVE-2020-13965
9 Jun 202000:00
–attackerkb
BDU FSTEC		The vulnerability of the RoundCube Webmail email client, related to deficiencies in the security measures used to protect web page structures, allows attackers to compromise data integrity.
19 Aug 202000:00
–bdu_fstec
GithubExploit		Exploit for Cross-site Scripting in Roundcube Webmail
13 Feb 202513:56
–githubexploit
Circl		CVE-2020-13965
26 Jun 202418:10
–circl
CISA KEV Catalog		Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
26 Jun 202400:00
–cisa_kev
CISA		 CISA Adds Three Known Exploited Vulnerabilities to Catalog
26 Jun 202412:00
–cisa
CNVD		Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2020-36520)
10 Jun 202000:00
–cnvd
Cvelist		CVE-2020-13965
9 Jun 202002:45
–cvelist
Debian		[SECURITY] [DSA 4700-1] roundcube security update
11 Jun 202006:20
–debian
Debian		[SECURITY] [DSA 4700-1] roundcube security update
11 Jun 202006:20
–debian
Rows per page
NVD
Vulnrichment
Node
OR
roundcubewebmailRange<1.3.12
roundcubewebmailRange1.4.0–1.4.5
Node
OR
debiandebian_linuxMatch9.0
debiandebian_linuxMatch10.0
Node
OR
fedoraprojectfedoraMatch31
fedoraprojectfedoraMatch32
SourceLink
debianwww.debian.org/security/2020/dsa-4700
githubwww.github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube
listswww.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/
roundcubewww.roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12
listswww.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/
githubwww.github.com/roundcube/roundcubemail/releases/tag/1.3.12
githubwww.github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5
githubwww.github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3
githubwww.github.com/roundcube/roundcubemail/releases/tag/1.4.5
cisawww.cisa.gov/known-exploited-vulnerabilities-catalog
Rows per page
ParameterPositionPathDescriptionCWE
_taskquery param/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=getXSS via malicious XML attachment download endpoint in Roundcube WebmailCWE-79, CWE-80
_mboxquery param/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=getXSS via malicious XML attachment download endpoint in Roundcube WebmailCWE-79, CWE-80
_uidquery param/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=getXSS via malicious XML attachment download endpoint in Roundcube WebmailCWE-79, CWE-80
_partquery param/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=getXSS via malicious XML attachment download endpoint in Roundcube WebmailCWE-79, CWE-80
_downloadquery param/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=getXSS via malicious XML attachment download endpoint in Roundcube WebmailCWE-79, CWE-80
_actionquery param/?_task=mail&_mbox=INBOX&_uid=[UID]&_part=2&_download=0&_action=getXSS via malicious XML attachment download endpoint in Roundcube WebmailCWE-79, CWE-80

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 02:54Current
7High risk
Vulners AI Score7
CVSS 24.3
CVSS 3.16.1 - 6.3
EPSS0.76596
SSVC
CWE-80CWE-79In Wild
cve202013965roundcube webmailxssvulnerabilityremote code executionxml attachment
230