MAL-004

MAL-004: Command Injection Bypass for CVE-2020-12641 in Roundcube Webmail A bypass was found for "CVE-2020-12641: Command Injection via "imconvertpath" in Roundcube Webmail" affecting versions before 1.4.5, 1.3.12. The php “escapeshellcmd” function, implemented to prevent “CVE-2020-12641: Command...

CVE-2024-42009

CVE-2024-42009 PoC: Email Capture Listener & XSS Exploit Overview This Proof of Concept PoC demonstrates an exploit for CVE-2024-42009, leveraging a cross-site scripting XSS vulnerability to extract emails from a target webmail application. The attack injects a malicious payload that exfiltrates...

CVE-2025-49113-Simulation

Roundcube RCE Lab CVE-2025-49113 A hands-on, containerized lab environment to simulate and exploit a critical Post-Authentication RCE vulnerability in Roundcube Webmail, identified as CVE-2025-49113. 📖 About The Vulnerability This lab demonstrates a sophisticated attack chain against the Roundcub...

CVE-2020-12625

CVE-2020-12625: Cross-Site Scripting via Malicious HTML Attachment in Roundcube Webmail A Cross-Site scripting XSS vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. By leveraging the "" XML element in a mail with a "text/html" attachment, an attacker can bypass the...

CVE-2025-68461

CVE-2025-68461 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting XSS vulnerability via the animate tag in an SVG document. How does this detection method work? Extracts Roundcube version from the "rcversion" JSON field in the response, parses it into...

CVE-2026-129168

PMail versions 2.9.1 through 2.9.8 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the /attachments/{id}/{cid} endpoint, which returns email attachments verbatim using the sender-supplied Content-Type after rewriting cid: references into links. This allows unauthe...

EUVD-2026-125599

PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/id/cid endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a...

CVE-2024-42009-PoC

CVE-2024-42009 PoC: Email Capture Listener & XSS Exploit in Roundcube Webmail Overview This repository contains a proof-of-concept PoC exploit for CVE-2024-42009 a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail version 1.6.7 and other several versions. The exploit demonstrates...

CVE-2024-37383-exploit

Exploit Title: Roundcube mail server exploit for CVE-2024-37383 Stored XSS Google Dork: Exploit Author: AmirZargham Vendor Homepage: Roundcube - Free and Open Source Webmail Software Software Link: Releases · roundcube/roundcubemail Version: Roundcube client version earlier than 1.5.6 or from 1.6...

SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340: Insecure Direct Object Reference IDOR vulnerability in SOGo Webmail CVE ID: CVE-2025-50340 Reporter: Milad Seddigh Product: SOGo Affected Versions: v5.6.0 Impact: Insecure Direct Object Reference IDOR vulnerability → Allows the user to send emails on behalf of another user. Summar...

xCrack Python Tools For Hackers

TG Download Link: https://t.me/+0z9FapS4mBgyZjhl xCrack Python Hacking Tool for Hackers And Spammers Requirements: Python 3.x Tested On: Python 3.10.4 ► cPanel Section ◄ Mass cPanel Active Checker Mass cPanel To Shell Uploader Mass cPanel To SMTP Cracker Mass cPanel To Webmail Cracker Mass cPanel...

CVE-2025-49113

📧 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization CVE-2025-49113 🔍 Writeup A critical post-authentication Remote Code Execution vulnerability was discovered in Roundcube versions ≤ 1.6.10, caused by insecure PHP object deserialization. This severe flaw has silently persisted in th...

CVE-2024-42009

CVE-2024-42009 – Reflected XSS in Roundcube Webmail 📌 Overview This repository contains a Nuclei template and supporting resources to safely demonstrate and validate CVE-2024-42009 , a critical reflected XSS vulnerability in Roundcube Webmail. The flaw resides in the messagebody function in...

CVE-2020-13965

CVE-2020-13965: Cross-Site Scripting via Malicious XML Attachment in Roundcube Webmail A Cross-Site scripting XSS vulnerability exists in Roundcube versions before 1.4.5 and 1.3.12. By leveraging the parsing of "text/xml" attachment, an attacker can bypass the Roundcube script filter and execute...

CVE-2025-49113-exploit

CVE-2025-49113 - Roundcube Remote Code Execution A proof-of-concept exploit for CVE-2025-49113, a remote code execution vulnerability in Roundcube Webmail. Description This exploit targets a deserialization vulnerability in Roundcube Webmail versions 1.5.0 through 1.6.10. The vulnerability allows...

CVE-2025-49113

CVE-2025-49113 – Roundcube Webmail RCE Exploit Python PoC CVE ID: CVE-2025-49113 Exploit Type: Remote Code Execution via PHP Object Injection Application: Roundcube Webmail ≤ 1.5.9 and ≤ 1.6.10 Exploit Language: Python Author: 00xCanelo Status: Tested and Working on Vulnerable Roundcube...

Roundcube-CVE-2024-42008-POC

CVE-2024-42008 RoundCube XSS Exploit Overview This repository contains a proof-of-concept exploit for CVE-2024-42008 , a Cross-Site Scripting XSS vulnerability in RoundCube webmail application. This exploit is designed for educational purposes and controlled penetration testing environments like...

CVE-2023-08-21-exploit

Exploit Title: Axigen if xhr1.readyState === XMLHttpRequest.DONE hcookie = new URLxhr1.responseURL.search.split"="1; xhr2.open'PATCH',...

CVE-2026-48842

CVE-2026-48842 — Roundcube virtuserquery pre-auth SQLi Python 3 checker for CVE-2026-48842 in Roundcube Webmail optional virtuserquery plugin. PoCbit This PoC is listed on PoCbit — CVE-2026-48842 on pocbit.org. Running the PoC prints a PoCbit header; JSONL lines include pocbit / pocbitpage. |...

Zimbra Collaboration - Cross-Site Scripting (XSS)

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...