Roundcube_CVE-2025-49113

RCE in Roundcube CVE-2025-49113 - My Obsidian note .md date time Status: Completed Lab: Easy Tags: RCE | PHP | LABTHM | EXPLOIT | CVE by KRPT Paulo G. Werneck - Linkedin - in.com/pgw-script Impact : remote command execution post-login CVSS 9.9 Affected versions : ≤ 1.5.10 / 1.6.10 Patched : 1.5.1...

CVE-2024-42009-roundcube-xss

CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS PoC For authorised security testing, CTF environments, and educational research only. Using this tool against systems you do not own or have written permission to test is illegal under the Computer Misuse Act 1990 UK, the CFAA US, and equivalent...

exploit-CVE-2016-9920

Roundcube 1.0.0 = 1.2.2 Remote Code Execution Roundcube is a widely distributed open-source webmail software used by many organizations and companies around the globe. The mirror on SourceForge, for example, counts more than 260,000 downloads in the last 12 months which is only a small fraction o...

CVE-2020-12640

CVE-2020-12640: Local PHP File Inclusion via "Plugin Value" in Roundcube Webmail A Path Traversal vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "plugins" parameters do not perform sanitization/input filtering, an attacker with access to the Roundcube...

CVE-2024-42009

CVE-2024-42009 – Reflected XSS in Roundcube Webmail 📌 Overview This repository contains a Nuclei template and supporting resources to safely demonstrate and validate CVE-2024-42009 , a critical reflected XSS vulnerability in Roundcube Webmail. The flaw resides in the messagebody function in...

CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

EUVD-2026-104794

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands...

CVE-2026-113386

Roundcube Webmail is vulnerable to IMAP command injection in versions before 1.6.20 and 1.7.x before 1.7.5. A remote authenticated attacker can exploit this by injecting CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions. This allows the execution of arbitrary ...

CVE-2025-49113-Roundcube_1.6.10

CVE-2025-49113 – Roundcube 1.6.10 Authenticated Remote Code Execution ⚠️ Disclaimer This repository is intended strictly for educational and research purposes. All demonstrations were performed in a controlled lab environment. Unauthorized testing or exploitation of systems without explicit...

CVE-2025-49113-Simulation

Roundcube RCE Lab CVE-2025-49113 A hands-on, containerized lab environment to simulate and exploit a critical Post-Authentication RCE vulnerability in Roundcube Webmail, identified as CVE-2025-49113. 📖 About The Vulnerability This lab demonstrates a sophisticated attack chain against the Roundcub...

CVE-2024-37383-exploit

Exploit Title: Roundcube mail server exploit for CVE-2024-37383 Stored XSS Google Dork: Exploit Author: AmirZargham Vendor Homepage: Roundcube - Free and Open Source Webmail Software Software Link: Releases · roundcube/roundcubemail Version: Roundcube client version earlier than 1.5.6 or from 1.6...

CVE-2025-49113-nuclei-template

Nuclei vulnerability detection template - CVE-2025-49113 - Roundcube ≤ 1.6.10 Post-Authentication Remote Code Execution CVE ID: CVE-2025-49113 Severity: Critical CVSS 10.0 Discovered by: Kirill Firsov FearsOff Date Disclosed: June 1, 2025 Fixed in: Roundcube 1.6.11 / 1.5.10 LTS -...

CVE-2024-42009-PoC

CVE-2024-42009 PoC: Email Capture Listener & XSS Exploit in Roundcube Webmail Overview This repository contains a proof-of-concept PoC exploit for CVE-2024-42009 a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail version 1.6.7 and other several versions. The exploit demonstrates...

CVE-2017-16651

CVE-2017-16651 Python implementation of Roundcube LFI CVE-2017-16651...

CVE-2025-49113

CVE-2025-49113 Detection NOTE This template has now been implemented into CERT Polska's tool Artemis. I’m deeply honoured to be acknowledged by CERT Polska for this vulnerability detection script. It is a true privilege to play a part in strengthening global cyber security efforts through...

CVE-2024-42009

XSS Exploit for Roundcube Webmail 1.6.7 CVE-2024-42009 Description This script exploits a stored XSS vulnerability CVE-2024-42009 in Roundcube Webmail version 1.6.7. It injects a malicious payload into the webmail system, which, when triggered, exfiltrates email content from the victim’s inbox...

CVE-2025-49113

📧 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization CVE-2025-49113 🔍 Writeup A critical post-authentication Remote Code Execution vulnerability was discovered in Roundcube versions ≤ 1.6.10, caused by insecure PHP object deserialization. This severe flaw has silently persisted in th...

CVE-2025-49113

CVE-2025-49113 – Roundcube Webmail RCE Exploit Python PoC CVE ID: CVE-2025-49113 Exploit Type: Remote Code Execution via PHP Object Injection Application: Roundcube Webmail ≤ 1.5.9 and ≤ 1.6.10 Exploit Language: Python Author: 00xCanelo Status: Tested and Working on Vulnerable Roundcube...

CVE-2025-49113-exploit

CVE-2025-49113 - Roundcube Remote Code Execution A proof-of-concept exploit for CVE-2025-49113, a remote code execution vulnerability in Roundcube Webmail. Description This exploit targets a deserialization vulnerability in Roundcube Webmail versions 1.5.0 through 1.6.10. The vulnerability allows...