PT-2020-3640 · Roundcube +3 · Roundcube Webmail +3

🗓️ 09 Nov 2019 00:00:00Reported by Positive TechnologiesType

Roundcube Webmail XSS via XML attachment may affect data integrity; update to 1.3.12+ or 1.4.5+.

Reporter	Title	Published	Views	Family All 365
GithubExploit	Exploit for SQL Injection in Roundcube Webmail	14 Nov 202311:32	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Roundcube Webmail	13 Feb 202513:56	–	githubexploit
ATTACKERKB	CVE-2020-13965	9 Jun 202000:00	–	attackerkb
ATTACKERKB	CVE-2021-44026	19 Nov 202100:00	–	attackerkb
ATTACKERKB	CVE-2020-35730	28 Dec 202000:00	–	attackerkb
ATTACKERKB	CVE-2020-12641	4 May 202000:00	–	attackerkb
ArchLinux	[ASA-202101-2] roundcubemail: cross-site scripting	4 Jan 202100:00	–	archlinux
Information Security Automation	Vulnerabilities of Western logistics	27 May 202523:55	–	avleonov
Information Security Automation	About Cross Site Scripting – MDaemon Email Server (CVE-2024-11182)	29 May 202521:46	–	avleonov
Circl	CVE-2020-12641	22 Jun 202318:10	–	circl

Source	Link
github	www.github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12641-Command%20Injection-Roundcube
github	www.github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube
github	www.github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12640-PHP%20Local%20File%20Inclusion-Roundcube
github	www.github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-Roundcube
github	www.github.com/pentesttoolscom/roundcube-cve-2021-44026
github	www.github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3
github	www.github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5
osv	www.osv.dev/vulnerability/BIT-roundcube-2020-13965
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
cve	www.cve.mitre.org/cgi-bin/cvename.cgi

13 Feb 2025 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.16.3 - 9.8

CVSS 27.5

EPSS0.93275