UBUNTU-CVE-2026-126813

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...

CVE-2026-126813

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...

CVE-2026-126813

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...

CVE-2026-126813 Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...

CVE-2026-126813

Roundcube Webmail versions before 1.6.21 and 1.7.x before 1.7.6 are vulnerable to an IMAP command injection vulnerability. The root cause is the improper neutralization of CRLF sequences in the _uid parameter when the messages_cache feature is enabled. An attacker can lure a logged-in victim into...

CVE-2026-126813 Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...

CVE-2026-126813

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...

EUVD-2026-124028

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/ge...

PT-2026-145470

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messages cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or...

CVE-2020-29653

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags...