CVE-2022-32734

...

CVE-2022-45117

...

CVE-2018-12157

...

CVE-2019-19759

...

CVE-2023-1673

...

CVE-2020-12576

...

CVE-2020-24540

...

CVE-2020-35588

...

CVE-2017-1015

...

CVE-2022-4852

...

CVE-2024-9625

...

CVE-2024-12095

...

CVE-2025-48745

Roundcube Webmail is affected by CVE-2025-49113: an authenticated attacker can exploit PHP object deserialization via the unvalidated _from URL parameter in program/actions/settings/upload.php to achieve remote code execution. Vulnerable versions include Roundcube before 1.5.10 and 1.6.x before 1...

CVE-2022-20424

...

CVE-2024-23404

...

CVE-2022-45125

The CVE-2022-45125 entry is rejected/unused and does not represent an active vulnerability.

CVE-2021-23090

...

CVE-2021-43865

...

CVE-2020-2058

...

CVE-2025-48425

...