EUVD-2019-18371

Malware in sbrugna...

EUVD-2010-4433

Malware in sbrugna...

EUVD-2010-3679

Malware in sbrugna...

EUVD-2006-0800

Malware in sbrugna...

EUVD-2019-18370

Malware in sbrugna...

EUVD-2022-30681

Malicious code in bioql PyPI...

EUVD-2023-49513

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2019-9858

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in...

CVE-2024-45515

An issue was discovered in Zimbra Collaboration ZCS through 10.1. A Cross-Site Scripting XSS vulnerability exists in Zimbra webmail due to insufficient validation of the content type metadata when importing files into the briefcase. Attackers can exploit this issue by crafting a file with...

ROS-20250703-09

Vulnerability of RoundCube Webmail mail client is related to flaws in deserialization mechanism of from parameter processing. processing the from parameter. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary code by sending a specially crafted request...

USN-7584-1: Roundcube vulnerability

It was discovered that Roundcube Webmail did not properly sanitize the from parameter in a URL, leading to PHP Object Deserialization. A remote attacker could possibly use this issue to execute arbitrary code...

PT-2025-24632 · Undefined · Undefined

CISA has just added three new vulnerabilities to its Known Exploited Vulnerabilities KEV catalog: Erlang OTP CVE-2024-39992 OpenSSH CVE-2024-39993 Roundcube Webmail CVE-2024-39994 These vulnerabilities are actively being exploited in the wild and must be patched by June 25, 2025, as per Binding...

Roundcube Webmail Deserialization Vulnerability

RoundCube Webmail is a browser-based open source multi-language IMAP client , using PHP + Ajax development , to provide a desktop application-like interface and complete mail management features . Roundcube Webmail has a deserialization vulnerability , the vulnerability stems from the...

CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization...

Roundcube Webmail RCE Vulnerability (Jun 2025) - Windows

Roundcube Webmail is prone to an authenticated remote code execution RCE vulnerability via php object deserialization. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2024-45517

An issue was discovered in Zimbra Collaboration ZCS through 10.1. A Cross-Site Scripting XSS vulnerability in the /h/rest endpoint of the Zimbra webmail and admin panel interfaces allows attackers to execute arbitrary JavaScript in the victim's session. This issue is caused by improper sanitizati...

CVE-2018-17792

MDaemon Webmail formerly WorldClient has CSRF...

Roundcube Webmail 1.6.x < 1.6.3 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.4.14 or 1.5.x prior to 1.5.4 or 1.6.x prior to 1.6.3. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via text/plain e-mail messages with crafted links. Note that the scanner has not tested fo...

Roundcube Webmail < 1.4.14 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.4.14 or 1.5.x prior to 1.5.4 or 1.6.x prior to 1.6.3. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via text/plain e-mail messages with crafted links. Note that the scanner has not tested fo...

CVE-2024-45513

An issue was discovered in Zimbra Collaboration ZCS through 10.1. A stored Cross-Site Scripting XSS vulnerability exists in the /modern/contacts/print endpoint of Zimbra webmail. This allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser when a...