CVE-2020-12641

CVE-2020-12641: Внедрение команд через параметр “imconvertpath” в Roundcube Webmail Уязвимость внедрения команд существует в Roundcube версиях до 1.4.4, 1.3.11 и 1.2.10. Поскольку параметр “imconvertpath” не выполняет санитизацию/фильтрацию входных данных, злоумышленник, имеющий доступ к...

CVE-2020-12625

CVE-2020-12625 : Cross-Site Scripting via une pièce jointe HTML malveillante dans Roundcube Webmail Une vulnérabilité de Cross-Site scripting XSS existe dans les versions de Roundcube antérieures à 1.4.4, 1.3.11 et 1.2.10. En exploitant l'élément XML "" dans un courriel avec une pièce jointe...

CVE-2020-13965

CVE-2020-13965: Roundcube Webmail의 악성 XML 첨부 파일을 통한 교차 사이트 스크립팅 Roundcube 1.4.5 및 1.3.12 이전 버전에는 교차 사이트 스크립팅XSS 취약점이 존재합니다. 공격자는 text/xml 첨부 파일의 구문 분석을 악용하여 Roundcube 스크립트 필터를 우회하고, 악성 첨부 파일을 클릭하거나 미리 볼 때 피해자 브라우저에서 임의의 악성 JavaScript를 실행할 수 있습니다. 공급업체 공개: 이 취약점에 대한 공급업체의 공개 및 수정 사항은 여기에서 확인할 수...

CVE-2020-12640

CVE-2020-12640: Inclusion locale de fichier PHP via la « valeur de plugin » dans Roundcube Webmail Une vulnérabilité de type Path Traversal existe dans les versions de Roundcube antérieures à 1.4.4, 1.3.11 et 1.2.10. Étant donné que les paramètres plugins n'effectuent pas d'assainissement/filtrag...

CVE-2025-49113

CVE-2025-49113 – Roundcube Remote Code Execution RCE PoC Этот репозиторий содержит эксплойт Proof-of-Concept PoC для CVE-2025-49113 , критической уязвимости удалённого выполнения кода в Roundcube Webmail версий до 1.5.10 и 1.6.11. Уязвимость возникает из-за небезопасной десериализации PHP-объекто...

CVE-2025-49113-Roundcube-RCE-PHP

CVE-2025-49113-Roundcube-RCE-PHP Versions 1.5.0 à 1.6.10 de Roundcube Webmail Ceci est un exploit réécrit pour fonctionner avec PHP. Utilisation root@kitploit: php CVE-2025-49113.php...

CVE-2025-49113

نص بايثون لـ CVE-2025-49113 Usage: python exploit.py https://ubuntu.com/security/CVE-2025-49113 الوصف: Roundcube Webmail قبل الإصدار 1.5.10 والإصدارات 1.6.x قبل 1.6.11 تسمح بتنفيذ الأكواد عن بُعد من قبل المستخدمين المصادق عليهم لأن المعامل from في عنوان URL لا يتم التحقق منه في...

CVE-2024-42009

Exploit XSS pour Roundcube Webmail 1.6.7 CVE-2024-42009 Description Ce script exploite une vulnérabilité XSS stockée CVE-2024-42009 dans Roundcube Webmail version 1.6.7. Il injecte une charge utile malveillante dans le système de webmail qui, lorsqu'elle est déclenchée, exfiltre le contenu des...

CVE-2025-49113

CVE-2025-49113 – استغلال تنفيذ الأوامر عن بُعد في Roundcube Webmail إثبات المفهوم بلغة بايثون معرف CVE: CVE-2025-49113 نوع الاستغلال: تنفيذ أوامر عن بُعد عبر حقن كائنات PHP التطبيق: Roundcube Webmail ≤ 1.5.9 و ≤ 1.6.10 لغة الاستغلال: بايثون المؤلف: 00xCanelo الحالة: تم اختباره ويعمل على تثبيتات...

CVE-2026-74998

A flaw was found in Roundcube Webmail. Responses from the Cascading Style Sheets CSS proxy were not properly validated. This could allow a remote attacker to exploit MIME sniffing vulnerabilities, resulting in information disclosure or Cross-Site Scripting XSS...

CVE-2026-74997

A flaw was found in Roundcube Webmail. The cmdlearn driver of the markasjunk plugin is vulnerable to remote code execution via crafted placeholder replacement values...

CVE-2026-48849-Roundcube-Webmail-Stored-XSS

CVE-2026-48849 - XSS stocké, Injection HTML et Injection CSS dans Roundcube Webmail Aperçu Ce dépôt contient une preuve de concept PoC pour CVE-2026-48849 , une vulnérabilité de Cross-Site Scripting XSS stocké, d'injection HTML et d'injection CSS dans Roundcube Webmail. La vulnérabilité permet au...

Linux Distros Unpatched Vulnerability : CVE-2026-74999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the Add to address book action was subject to stored XSS. CVE-2026-74999 Note that Nessus relies on t...

Linux Distros Unpatched Vulnerability : CVE-2026-75007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead ...

Linux Distros Unpatched Vulnerability : CVE-2026-74998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in informati...

Linux Distros Unpatched Vulnerability : CVE-2026-74997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-75010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a...

Linux Distros Unpatched Vulnerability : CVE-2026-75002

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privile...

Linux Distros Unpatched Vulnerability : CVE-2026-75000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate by attribute may lead to remote image blocking...

CVE-2026-75006

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...