CVE-2025-49113-Simulation

Laboratório Roundcube RCE CVE-2025-49113 Um ambiente de laboratório prático e containerizado para simular e explorar uma vulnerabilidade crítica de RCE pós-autenticação no Roundcube Webmail, identificada como CVE-2025-49113. 📖 Sobre a Vulnerabilidade Este laboratório demonstra uma cadeia de ataqu...

CVE-2024-42009

CVE-2024-42009 – XSS riflesso in Roundcube Webmail 📌 Panoramica Questo repository contiene un template Nuclei e risorse di supporto per dimostrare e validare in sicurezza CVE-2024-42009 , una vulnerabilità critica di XSS riflesso in Roundcube Webmail. Il difetto risiede nella funzione messagebody...

CVE-2025-49113_exploit_cookies

CVE-2025-49113 - Vulnerabilità di Esecuzione Remota di Codice in Roundcube Webmail Panoramica Tecnica CVE-2025-49113 è una vulnerabilità critica di deserializzazione non sicura in Roundcube Webmail che consente l'esecuzione remota di codice autenticata. La vulnerabilità deriva da una gestione...

CVE-2024-42009

CVE-2024-42009 – XSS Memorizzato in Roundcube PoC Docker 📌 Panoramica Questo repository dimostra un Proof-of-Concept PoC funzionante per CVE-2024-42009 , una vulnerabilità di Cross-Site Scripting XSS memorizzata in Roundcube Webmail. La vulnerabilità è causata da una sanitizzazione HTML impropria...

CVE-2025-49113

CVE-2025-49113 – Exploit RCE per Roundcube Webmail PoC Python ID CVE: CVE-2025-49113 Tipo di Exploit: Remote Code Execution tramite PHP Object Injection Applicazione: Roundcube Webmail ≤ 1.5.9 e ≤ 1.6.10 Linguaggio dell'Exploit: Python Autore: 00xCanelo Stato: Testato e funzionante su installazio...

CVE-2025-49113

Script Python per CVE-2025-49113 Utilizzo: python exploit.py https://ubuntu.com/security/CVE-2025-49113 Descrizione: Roundcube Webmail precedente alla versione 1.5.10 e 1.6.x precedenti alla 1.6.11 consente l'esecuzione remota di codice da parte di utenti autenticati perché il parametro from in u...

CVE-2024-42009

राउंडक्यूब वेबमेल 1.6.7 के लिए XSS शोषण CVE-2024-42009 विवरण यह स्क्रिप्ट राउंडक्यूब वेबमेल संस्करण 1.6.7 में एक संग्रहीत XSS कमजोरी CVE-2024-42009 का शोषण करती है। यह वेबमेल सिस्टम में एक दुर्भावनापूर्ण पेलोड इंजेक्ट करती है, जो ट्रिगर होने पर पीड़ित के इनबॉक्स से ईमेल सामग्री को बाहर निकाल लेती...

CVE-2025-68461

Scanner CVE-2025-68461 Uno strumento di sicurezza in C++ per rilevare vulnerabilità di Cross-Site Scripting XSS nelle installazioni di Roundcube Webmail. Impatto Accesso non autorizzato agli account utente Dirottamento di sessione Esposizione dei dati Azioni non autorizzate per conto degli utenti...

Roundcube Webmail - Remote Code Execution

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. id: CVE-2025-49113 info: name: Roundcube Webmail - Remote...

roundcube-cve-2025-49113-lab

HAFTUNGSAUSSCHLUSS: Nur für Bildungszwecke Roundcube Webmail RCE – CVE-2025-49113 Lab Dieses Repository dokumentiert meine schrittweise Ausnutzung von Roundcube Webmail CVE-2025-49113 in einer kontrollierten Laborumgebung, um das in /secret.txt gespeicherte Geheimnis zu erlangen. ⚠️...

CVE-2026-74998

A flaw was found in Roundcube Webmail. Responses from the Cascading Style Sheets CSS proxy were not properly validated. This could allow a remote attacker to exploit MIME sniffing vulnerabilities, resulting in information disclosure or Cross-Site Scripting XSS...

CVE-2026-74997

A flaw was found in Roundcube Webmail. The cmdlearn driver of the markasjunk plugin is vulnerable to remote code execution via crafted placeholder replacement values...

CVE-2026-48849-Roundcube-Webmail-Stored-XSS

CVE-2026-48849 - XSS persistente, HTML Injection e CSS Injection in Roundcube Webmail Panoramica Questo repository contiene un Proof-of-Concept PoC per CVE-2026-48849 , una vulnerabilità di XSS persistente, HTML Injection e CSS Injection in Roundcube Webmail. La vulnerabilità permette che HTML, C...

Linux Distros Unpatched Vulnerability : CVE-2026-74999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the Add to address book action was subject to stored XSS. CVE-2026-74999 Note that Nessus relies on t...

Linux Distros Unpatched Vulnerability : CVE-2026-74998

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in informati...

Linux Distros Unpatched Vulnerability : CVE-2026-74997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-75007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead ...

Linux Distros Unpatched Vulnerability : CVE-2026-75010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a...

Linux Distros Unpatched Vulnerability : CVE-2026-75002

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privile...

Linux Distros Unpatched Vulnerability : CVE-2026-75000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate by attribute may lead to remote image blocking...