CVE-2024-37383-exploit

Exploit Title: Roundcube mail server exploit for CVE-2024-37383 Stored XSS Google Dork: Exploit Author: AmirZargham Vendor Homepage: Roundcube - Free and Open Source Webmail Software Software Link: Releases · roundcube/roundcubemail Version: Roundcube client version earlier than 1.5.6 or from 1.6...

CVE-2024-42009-roundcube-xss

CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS PoC For authorised security testing, CTF environments, and educational research only. Using this tool against systems you do not own or have written permission to test is illegal under the Computer Misuse Act 1990 UK, the CFAA US, and equivalent...

CVE-2025-49113-Roundcube_1.6.10

CVE-2025-49113 – Roundcube 1.6.10 Ejecución Remota de Código Autenticada ⚠️ Aviso Este repositorio está destinado exclusivamente para fines educativos y de investigación. Todas las demostraciones se realizaron en un entorno de laboratorio controlado. El uso no autorizado de pruebas o la explotació...

CVE-2025-49113-Simulation

Roundcube RCE Lab CVE-2025-49113 A hands-on, containerized lab environment to simulate and exploit a critical Post-Authentication RCE vulnerability in Roundcube Webmail, identified as CVE-2025-49113. 📖 About The Vulnerability This lab demonstrates a sophisticated attack chain against the Roundcub...

CVE-2024-42009

CVE-2024-42009 – Reflected XSS in Roundcube Webmail 📌 Overview This repository contains a Nuclei template and supporting resources to safely demonstrate and validate CVE-2024-42009 , a critical reflected XSS vulnerability in Roundcube Webmail. The flaw resides in the messagebody function in...

CVE-2025-68461

CVE-2025-68461 Scanner A C++ security scanner tool to detect Cross-Site Scripting XSS vulnerabilities in Roundcube Webmail installations. Impact Unauthorized access to user accounts Session hijacking Data exposure Unauthorized actions on behalf of users Affected Versions The scanner checks for th...

CVE-2020-12640

CVE-2020-12640: Local PHP File Inclusion via "Plugin Value" in Roundcube Webmail A Path Traversal vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "plugins" parameters do not perform sanitization/input filtering, an attacker with access to the Roundcube...

CVE-2025-49113-nuclei-template

Nuclei vulnerability detection template - CVE-2025-49113 - Roundcube ≤ 1.6.10 Post-Authentication Remote Code Execution CVE ID: CVE-2025-49113 Severity: Critical CVSS 10.0 Discovered by: Kirill Firsov FearsOff Date Disclosed: June 1, 2025 Fixed in: Roundcube 1.6.11 / 1.5.10 LTS root@kitploit: -...

CVE-2024-42009-PoC

CVE-2024-42009 PoC: Captura de Correo Electrónico y Exploit XSS en Roundcube Webmail Resumen Este repositorio contiene una prueba de concepto PoC para CVE-2024-42009 , una vulnerabilidad de Cross-Site Scripting XSS almacenado en Roundcube Webmail versión 1.6.7 y otras versiones. El exploit...

CVE-2017-16651

CVE-2017-16651 Python implementation of Roundcube LFI CVE-2017-16651...

CVE-2025-49113

Detección de CVE-2025-49113 NOTA Esta plantilla ha sido implementada en la herramienta Artemis de CERT Polska. Estoy profundamente honrado de ser reconocido por CERT Polska por este script de detección de vulnerabilidades. Es un verdadero privilegio desempeñar un papel en el fortalecimiento de lo...

CVE-2024-42009

XSS Exploit for Roundcube Webmail 1.6.7 CVE-2024-42009 Description This script exploits a stored XSS vulnerability CVE-2024-42009 in Roundcube Webmail version 1.6.7. It injects a malicious payload into the webmail system, which, when triggered, exfiltrates email content from the victim’s inbox...

CVE-2025-49113

CVE-2025-49113 – Roundcube Webmail RCE Exploit Python PoC CVE ID: CVE-2025-49113 Exploit Type: Remote Code Execution via PHP Object Injection Application: Roundcube Webmail ≤ 1.5.9 and ≤ 1.6.10 Exploit Language: Python Author: 00xCanelo Status: Tested and Working on Vulnerable Roundcube...

CVE-2026-48849-Roundcube-Webmail-Stored-XSS

CVE-2026-48849 - Stored XSS, HTML Injection & CSS Injection in Roundcube Webmail Overview This repository contains a Proof-of-Concept PoC for CVE-2026-48849 , a Stored Cross-Site Scripting XSS, HTML Injection, and CSS Injection vulnerability in Roundcube Webmail. The vulnerability allows...

VulnCheck KEV: CVE-2026-48842

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuserquery plugin via a pregreplace backslash escape bypass...

CVE-2024-42008-9-exploit

CVE-2024-42008-9-exploit Los scripts en este repositorio están diseñados para explotar CVE-2024-42008 y CVE-2024-42009. Ambas son vulnerabilidades encontradas en Roundcube 1.6.7. Lea más sobre estas CVEs y cómo pueden ser explotadas en el siguiente enlace: root@kitploit:...

CVE-2020-12625

CVE-2020-12625: Cross-Site Scripting via Malicious HTML Attachment in Roundcube Webmail A Cross-Site scripting XSS vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. By leveraging the "" XML element in a mail with a "text/html" attachment, an attacker can bypass the...

CVE-2025-49113-Roundcube-RCE

CVE-2025-49113 — RCE post-autenticación en Roundcube mediante deserialización de objetos PHP Resumen...

Roundcube_CVE-2025-49113

RCE in Roundcube CVE-2025-49113 - My Obsidian note .md date time Status: Completed Lab: Easy Tags: RCE | PHP | LABTHM | EXPLOIT | CVE by KRPT Paulo G. Werneck - Linkedin - in.com/pgw-script Impact : remote command execution post-login CVSS 9.9 Affected versions : ≤ 1.5.10 / 1.6.10 Patched : 1.5.1...

CVE-2025-49113-PoC

CVE-2025-49113 Roundcube RCE PoC 🚀 Cómo ejecutar el proyecto 1. Iniciar el servidor vulnerable root@kitploit: cd Stand docker-compose up -d 2. Ejecutar el script contra el objetivo root@kitploit: cd PoC/src python3 scanner.py --target http://localhost:9000 --username test --password test...