CVE-2018-19206: Improper Neutralization of Input During Web Page Generation

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of...

CVE-2012-3507: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject...