CVE-2024-50964

MX Server misconfiguration CVE-2024-50964 Description A critical vulnerability has been identified in Ferozo Webmail v1.1 , where the MX Mail Exchange server of DonWeb completely disregards configured DMARC Domain-based Message Authentication, Reporting, and Conformance policies. Although domains...

CVE-2025-49113-Roundcube-RCE-PHP

CVE-2025-49113-Roundcube-RCE-PHP Roundcube Webmail versions 1.5.0 through 1.6.10 This is a rewritten exploit to work with PHP. Usage php CVE-2025-49113.php...

exploit-CVE-2025-49113

CVE-2025-49113 PoC Repository Overview of CVE-2025-49113 CVE-2025-49113 is a critical vulnerability affecting Roundcube Webmail versions prior to 1.5.10 and 1.6.11. Discovered in 2025, this flaw allows remote code execution RCE through PHP Object Deserialization in the /settings/upload.php...

CVE-2024-33231

Ferozo Webmail XSS Vulnerability via File Upload CVE-2024-33231 Description Ferozo Webmail version 1.1 is vulnerable to Cross-Site Scripting XSS through the file upload functionality. An attacker can exploit this vulnerability by uploading a specially crafted file containing malicious JavaScript...

Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Proof of Concept: CVE-2024-42008 and CVE-2024-42010 This proof of concept PoC demonstrates the exploitation of two vulnerabilities in Roundcube Webmail that enable CSS injection and a cross-site scripting XSS. The attack consists of two stages: 1. XSS via malicious XML attachment CVE-2024-42008...

CVE-2017-6913

CVE-2017-6913 This is a vulnerability I found in open-xchange OX App Suite's webmail https://www.open-xchange.com/ a while back. Vulnerability details The webmail was vulnerable to a stored XSS when opening an email, due to the event attributes of the HTML time tag not being properly filtered...

CVE-2025-44148

CVE-2025-44148 - Reflected Cross-Site Scripting Reflected XSS Reflected Cross-Site Scripting XSS in MailEnable Vendor: MailEnable Pty. Ltd. Affected Versions: 10 Description A reflected cross-site scripting XSS vulnerability exists in MailEnable Webmail due to improper user input sanitization in...

CVE-2025-49113-exploit

CVE-2025-49113 - Roundcube Remote Code Execution A proof-of-concept exploit for CVE-2025-49113, a remote code execution vulnerability in Roundcube Webmail. Description This exploit targets a deserialization vulnerability in Roundcube Webmail versions 1.5.0 through 1.6.10. The vulnerability allows...

CVE-2025-49113

📧 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization CVE-2025-49113 🔍 Writeup A critical post-authentication Remote Code Execution vulnerability was discovered in Roundcube versions ≤ 1.6.10, caused by insecure PHP object deserialization. This severe flaw has silently persisted in th...

CVE-2025-49113

CVE-2025-49113 – Roundcube Remote Code Execution RCE PoC This repository contains a Proof-of-Concept PoC exploit for CVE-2025-49113 , a critical remote code execution vulnerability in Roundcube Webmail versions prior to 1.5.10 and 1.6.11. The vulnerability arises from insecure PHP object...

Axigen WebMail - Cross-Site Scripting

Axigen WebMail versions 10.5.0-4370c946 and older are vulnerable to reflected XSS via the m parameter in the /index.hsp endpoint. id: CVE-2022-31470 info: name: Axigen WebMail - Cross-Site Scripting author: AmirZargham severity: medium description: | Axigen WebMail versions 10.5.0-4370c946 and...

Lotus Domino R5 and R6 WebMail - Information Disclosure

Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...

Roundcube Webmail - Cross-Site Scripting

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in messagebody in program/actions/mail/show.php. id: CVE-2024-42009 info: name:...

IceWarp Webmail Server v10.2.1 - Cross Site Scripting

Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. id: CVE-2023-37728 info: name: IceWarp Webmail Server v10.2.1 - Cross Site Scripting author: technicaljunkie,r3Y3r53 severity: medium description: | Icewarp Icearp v10.2.1 was...

Axigen WebMail - Cross-Site Scripting

Cross Site Scripting XSS vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions. id:...

Roundcube Webmail - Command Injection

Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for imconvertpath or imidentifypath, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings. id: CVE-2020-12641 info: name: Roundcube...

Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting

IceWarp Webmail Server through 11.4.4.1 contains a cross-site scripting vulnerability in the /webmail/ color parameter. id: CVE-2020-8512 info: name: IceWarp WebMail Server =11.4.4.2 or apply the vendor-provided patch to mitigate the vulnerability. reference: -...

CVE-2025-68645-Exploiting-Zimbra-Webmail-LFI-Vulnerability

CVE-2025-68645 — Zimbra Classic UI LFI Defender Pack This repository is a defender-focused reference pack for CVE-2025-68645 , a Local File Inclusion LFI issue in Zimbra Collaboration ZCS 10.0.x and 10.1.x Classic Webmail UI caused by improper handling of user-controlled request parameters in the...

CVE-2024-42009

CVE-2024-42009 – Roundcube Stored XSS Docker PoC 📌 Overview This repository demonstrates a working Proof-of-Concept PoC for CVE-2024-42009 , a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail. The vulnerability is caused by improper HTML sanitization followed by unsafe attribute...