CVE-2025-49113

Script Python per CVE-2025-49113 Utilizzo: python exploit.py https://ubuntu.com/security/CVE-2025-49113 Descrizione: Roundcube Webmail precedente alla versione 1.5.10 e 1.6.x precedenti alla 1.6.11 consente l'esecuzione remota di codice da parte di utenti autenticati perché il parametro from in u...

CVE-2024-42009

राउंडक्यूब वेबमेल 1.6.7 के लिए XSS शोषण CVE-2024-42009 विवरण यह स्क्रिप्ट राउंडक्यूब वेबमेल संस्करण 1.6.7 में एक संग्रहीत XSS कमजोरी CVE-2024-42009 का शोषण करती है। यह वेबमेल सिस्टम में एक दुर्भावनापूर्ण पेलोड इंजेक्ट करती है, जो ट्रिगर होने पर पीड़ित के इनबॉक्स से ईमेल सामग्री को बाहर निकाल लेती...

Lotus Domino R5 and R6 WebMail - Information Disclosure

Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...

CVE-2024-50964

MX Server Fehlkonfiguration CVE-2024-50964 Beschreibung Eine kritische Schwachstelle wurde in Ferozo Webmail v1.1 identifiziert, bei der der MX Mail Exchange-Server von DonWeb konfigurierte DMARC Domain-based Message Authentication, Reporting, and Conformance-Richtlinien vollständig ignoriert...

SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340: Unsichere direkte Objektreferenz IDOR-Schwachstelle in SOGo Webmail CVE ID: CVE-2025-50340 Reporter: Milad Seddigh Produkt: SOGo Betroffene Versionen: v5.6.0 Auswirkung: Unsichere direkte Objektreferenz IDOR-Schwachstelle → Ermöglicht dem Benutzer, E-Mails im Namen eines anderen...

CVE-2025-68461

Scanner CVE-2025-68461 Uno strumento di sicurezza in C++ per rilevare vulnerabilità di Cross-Site Scripting XSS nelle installazioni di Roundcube Webmail. Impatto Accesso non autorizzato agli account utente Dirottamento di sessione Esposizione dei dati Azioni non autorizzate per conto degli utenti...

CVE-2024-33231

Vulnerabilità XSS in Ferozo Webmail tramite caricamento di file CVE-2024-33231 Descrizione Ferozo Webmail versione 1.1 è vulnerabile al Cross-Site Scripting XSS tramite la funzionalità di caricamento dei file. Un attaccante può sfruttare questa vulnerabilità caricando un file appositamente...

Roundcube Webmail - Remote Code Execution

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. id: CVE-2025-49113 info: name: Roundcube Webmail - Remote...

roundcube-cve-2025-49113-lab

HAFTUNGSAUSSCHLUSS: Nur für Bildungszwecke Roundcube Webmail RCE – CVE-2025-49113 Lab Dieses Repository dokumentiert meine schrittweise Ausnutzung von Roundcube Webmail CVE-2025-49113 in einer kontrollierten Laborumgebung, um das in /secret.txt gespeicherte Geheimnis zu erlangen. ⚠️...

CVE-2024-37383-exploit

Título do exploit: Exploit do servidor de e-mail Roundcube para CVE-2024-37383 XSS armazenado Google Dork: Autor do exploit: AmirZargham Página inicial do fornecedor: Roundcube - Software de webmail gratuito e de código aberto Link do software: Lançamentos · roundcube/roundcubemail Versão: versão...

CVE-2026-74998

A flaw was found in Roundcube Webmail. Responses from the Cascading Style Sheets CSS proxy were not properly validated. This could allow a remote attacker to exploit MIME sniffing vulnerabilities, resulting in information disclosure or Cross-Site Scripting XSS...

CVE-2026-74997

A flaw was found in Roundcube Webmail. The cmdlearn driver of the markasjunk plugin is vulnerable to remote code execution via crafted placeholder replacement values...

CVE-2026-48849-Roundcube-Webmail-Stored-XSS

CVE-2026-48849 - XSS persistente, HTML Injection e CSS Injection in Roundcube Webmail Panoramica Questo repository contiene un Proof-of-Concept PoC per CVE-2026-48849 , una vulnerabilità di XSS persistente, HTML Injection e CSS Injection in Roundcube Webmail. La vulnerabilità permette che HTML, C...

Linux Distros Unpatched Vulnerability : CVE-2026-74999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the Add to address book action was subject to stored XSS. CVE-2026-74999 Note that Nessus relies on t...

Linux Distros Unpatched Vulnerability : CVE-2026-74998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in informati...

Linux Distros Unpatched Vulnerability : CVE-2026-74997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-75007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead ...

Linux Distros Unpatched Vulnerability : CVE-2026-75000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate by attribute may lead to remote image blocking...

Linux Distros Unpatched Vulnerability : CVE-2026-75010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a...

Linux Distros Unpatched Vulnerability : CVE-2026-75002

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privile...