CVE-2026-48842

CVE-2026-48842 — Roundcube virtuserquery pre-auth SQLi Python 3 checker for CVE-2026-48842 in Roundcube Webmail optional virtuserquery plugin. PoCbit This PoC is listed on PoCbit — CVE-2026-48842 on pocbit.org. Running the PoC prints a PoCbit header; JSONL lines include pocbit / pocbitpage. |...

CVE-2026-114731

A flaw was found in Roundcube Webmail. This flaw allows a remote attacker to trigger a Denial of Service DoS by exhausting server memory. The application's stylesheet proxy fails to enforce size limits or read timeouts when retrieving external content. By directing the proxy to fetch an...

CVE-2026-114729

A flaw was found in Roundcube Webmail. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing Scalable Vector Graphics SVG animations with an unvalidated animation attribute. The application's HTML sanitizer fails to inspect this attribute for remote...

CVE-2026-114726

A flaw was found in Roundcube Webmail. This vulnerability allows a remote attacker to inject arbitrary email headers by sending an email containing encoded carriage return and line feed CRLF control characters within the sender display name. When an affected user bounces or resends the message, t...

CVE-2026-114728

A flaw was found in Roundcube Webmail. The HTML message sanitizer fails to properly normalize all valid CSS escape sequences when inspecting external resource attributes. A remote attacker can exploit this flaw by sending a crafted email that bypasses remote content blocking, causing external...

CVE-2026-114725

A flaw was found in Roundcube Webmail. The application fails to properly sanitize newline characters in specific email header fields, including References, In-Reply-To, Message-ID, and From parameters. A remote authenticated attacker can exploit this vulnerability to inject arbitrary headers into...

CVE-2026-114719

A flaw was found in Roundcube Webmail. A remote attacker could conduct a Cross-Site Request Forgery CSRF attack to alter email classifications without user consent. By enticing an authenticated user into following a malicious link, the attacker exploits improper parameter handling in the markasju...

CVE-2026-114714

A flaw was found in Roundcube Webmail. When using the squirrelmailusercopy plugin with a file-based backend, the application constructs file paths from user login names without properly sanitizing path separators. An authenticated remote attacker can exploit this path traversal vulnerability by...

CVE-2025-49113

CVE-2025-49113 – Roundcube Webmail RCE Exploit Python PoC CVE ID: CVE-2025-49113 Exploit Type: Remote Code Execution via PHP Object Injection Application: Roundcube Webmail ≤ 1.5.9 and ≤ 1.6.10 Exploit Language: Python Author: 00xCanelo Status: Tested and Working on Vulnerable Roundcube...

Axigen WebMail - Cross-Site Scripting

Axigen WebMail versions 10.5.0-4370c946 and older are vulnerable to reflected XSS via the m parameter in the /index.hsp endpoint. id: CVE-2022-31470 info: name: Axigen WebMail - Cross-Site Scripting author: AmirZargham severity: medium description: | Axigen WebMail versions 10.5.0-4370c946 and...

Roundcube Webmail - Command Injection

Roundcube Webmail before 1.4.4 contains a command injection caused by shell metacharacters in configuration settings for imconvertpath or imidentifypath, letting attackers execute arbitrary code, exploit requires attacker to control configuration settings. id: CVE-2020-12641 info: name: Roundcube...

IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting

IceWarp Webmail Server through 11.4.4.1 contains a cross-site scripting vulnerability in the /webmail/ color parameter. id: CVE-2020-8512 info: name: IceWarp WebMail Server =11.4.4.2 or apply the vendor-provided patch to mitigate the vulnerability. reference: -...

Axigen WebMail - Cross-Site Scripting

Cross Site Scripting XSS vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions. id:...

IceWarp Webmail Server v10.2.1 - Cross Site Scripting

Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. id: CVE-2023-37728 info: name: IceWarp Webmail Server v10.2.1 - Cross Site Scripting author: technicaljunkie,r3Y3r53 severity: medium description: | Icewarp Icearp v10.2.1 was...

Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

Lotus Domino R5 and R6 WebMail - Information Disclosure

Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...

CVE-2023-08-21-exploit

Exploit Title: Axigen if xhr1.readyState === XMLHttpRequest.DONE hcookie = new URLxhr1.responseURL.search.split"="1; xhr2.open'PATCH',...

CVE-2024-37383_PoC

This is a repository for hands-on practice of the CVE-2024-37383 vulnerability. Analysis Report: blog / pdf CVE-2024-37383 Detail Name : Roundcube Webmail SVG Parsing XSS Target : Roundcube Webmail v1.5.7 or v1.6.x tag into an email, arbitrary scripts are executed in the browser. Exploit git clon...

CVE-2020-12641

CVE-2020-12641: Command Injection via “imconvertpath” Parameter in Roundcube Webmail A Command Injection vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "imconvertpath" does not perform sanitization/input filtering, an attacker with access to the Roundcube...

CVE-2020-13965

CVE-2020-13965: Cross-Site Scripting via Malicious XML Attachment in Roundcube Webmail A Cross-Site scripting XSS vulnerability exists in Roundcube versions before 1.4.5 and 1.3.12. By leveraging the parsing of "text/xml" attachment, an attacker can bypass the Roundcube script filter and execute...