CVE-2015-1433

CVE-2015-1433 affects Roundcube (Roundcube Webmail) where the file program/lib/Roundcube/rcube_washtml.php mishandles quoting in the HTML style attribute, enabling remote XSS via email content. The vulnerability arises from incorrect quotation logic during sanitization of the style HTML attribute...

CVE-2026-74998

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 fail to validate CSS proxy responses, enabling XSS or information disclosure through MIME sniffing. CVSS 7.2 (HIGH), network-reachable with no privileges. No in-the-wild exploitation reported. Fix: upgrade to 1.6.18 or 1.7.3 (commits...

CVE-2012-3508

CVE-2012-3508 is an XSS vulnerability in Roundcube Webmail 0.8.0 affecting the HTML email rendering path (program/lib/washtml.php), where attackers can inject script/HTML via a javascript: href in HTML-formatted emails. Connected advisories confirm remediation patches: updates to Roundcube 0.8.1 ...

CVE-2015-2181

CVE-2015-2181 affects Roundcube including the Password plugin DBMail driver. The vulnerability is a buffer overflow in the DBMail driver that exists in Roundcube before version 1.1.0 and could allow remote attackers to cause unspecified impact via the password or username fields. The connected do...

CVE-2009-0413

CVE-2009-0413 is an XSS vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable. An attacker could inject arbitrary HTML/script by exploiting the background attribute in HTML emails, leading to script execution in a user’s browser context. Public records show CVSS 2.0 base score 4.3 (AV:N/A...

CVE-2011-4078

CVE-2011-4078 affects Roundcube Webmail

CVE-2026-35538

This CVE affects Roundcube Webmail prior to 1.5.14 and prior to 1.6.14. The issue is unsanitized IMAP SEARCH arguments that can lead to IMAP injection or CSRF bypass during mail search. The connected sources indicate fixed releases: Roundcube 1.5.14 and 1.6.14 (and related security updates), so u...

CVE-2015-8864

CVE-2015-8864 is an XSS vulnerability in Roundcube Webmail, exploitable through a crafted SVG. Affected products are Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5. The issue allows remote attackers to inject arbitrary web script or HTML. The description explicitly notes this is a separate...

CVE-2016-4069

Roundcube Webmail is affected by CVE-2016-4069 (CSRF) in versions before 1.1.5. The vulnerability allows remote attackers to hijack user authentication for requests that download attachments, leading to a denial of service (disk consumption) via unspecified vectors. The available documents do not...

CVE-2011-2937

Roundcube Webmail vulnerability CVE-2011-2937 is a cross-site scripting (XSS) flaw in the UI messages functionality present before version 0.5.4. The issue allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI. The description specifies the vuln...

CVE-2014-9587

CVE-2014-9587 affects Roundcube Webmail prior to version 1.0.4, exposing multiple CSRF vulnerabilities that allow remote attackers to hijack user authentication via vectors tied to address book operations, ACL, or Managesieve plugins. Public references from SUSE/OpenSUSE and Debian indicate that ...

CVE-2018-1000071

Roundcube Webmail

CVE-2011-1491

CVE-2011-1491 affects Roundcube Webmail prior to 0.5.1. The issue is in the login form: an authenticated-but-unintended login sequence can be exploited to obtain sensitive information when a victim logs into the attacker’s account and composes an email, effectively a login CSRF vulnerability. Con...

CVE-2017-6820

CVE-2017-6820 affects Roundcube’s webmail software via rcube_utils.php. The vulnerability is a cross-site scripting (XSS) flaw caused by a crafted CSS token sequence inside an SVG element, impacting Roundcube versions before 1.1.8 and 1.2.x before 1.2.4. Exploitation details indicate a remote att...

CVE-2005-4368

CVE-2005-4368 affects Roundcube Webmail Alpha. When rcube_config['debug_level'] is set to 1 (default high verbose), an attacker can trigger an invalid_task to cause an error message that discloses the full application path. The available connected documents confirm the vulnerability description a...

CVE-2010-0464

CVE-2010-0464 affects Roundcube 0.3.1 and earlier, where the browser is not instructed to avoid DNS prefetching for domain names in email messages, enabling remote attackers to infer the user’s network location by DNS requests. Public references include Fedora backport and Debian backports adviso...

CVE-2015-8793

The CVE refers to a Cross-site scripting (XSS) vulnerability in Roundcube Webmail affecting the file program/include/rcmail.php, specifically in versions before 1.0.6 and 1.1.x before 1.1.2. The underlying issue is an XSS vector via the _mbox parameter in a mail task to the default URL, enabling ...

CVE-2012-6121

CVE-2012-6121 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail prior to 0.8.5. An attacker can inject arbitrary script/html via data:text or vbscript links, potentially affecting users who click such links. The issue is documented in multiple connected sources (e.g., SUSE securi...

CVE-2026-62642

The data identifies Roundcube Webmail as affected. Vulnerable component: the TNEF decoder, with an infinite loop leading to denial of service when opening emails containing TNEF attachments. Affected versions are Roundcube Webmail before 1.6.17 and before 1.7.2 (1.7.x). Remediation: upgrade to Ro...

CVE-2015-5381

Summary: The CVE-2015-5381 entry affects Roundcube Webmail 1.1.x before 1.1.2, where a cross-site scripting (XSS) vulnerability exists in the file program/include/rcmail.php . A remote attacker can exploit this by supplying a crafted payload to the _mbox parameter at the default URI, enabling inj...

CVE-2016-4552

CVE-2016-4552 affects Roundcube Webmail prior to 1.2.0. The vulnerability is a cross-site scripting (XSS) flaw that allows an attacker to inject arbitrary web script or HTML via the href attribute in an area tag within an e-mail message. Public references consistently describe it as a remote XSS ...

CVE-2009-4076

CVE-2009-4076 is a CSRF vulnerability in Roundcube Webmail 0.2.2 and earlier that could allow remote attackers to hijack a user’s authentication for requests that modify user information. Connected documents indicate a remediation: Fedora 10 security advisory MDVSA-2010:015 fixes CVE-2009-4076 (a...

CVE-2015-5382

The CVE-2015-5382 vulnerability affects Roundcube Webmail prior to 1.0.6 and 1.1.x prior to 1.1.2. Affected component: program/steps/addressbook/photo.inc. Root cause: information disclosure via the _alt parameter when uploading a vCard, allowing remote authenticated users to read arbitrary files...

CVE-2026-62644

CVE-2026-62644 affects Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, where the password plugin was vulnerable to username spoofing via session data, enabling potential account takeover. The underlying issue is a compromised or manipulated session state that could falsely attribute a use...

CVE-2026-74999

Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 is affected by a stored XSS in the "Add to address book" action. An authenticated attacker can inject malicious script that executes in the context of another user's session when they interact with the crafted address book entry. The CVSS 3.1...

CVE-2011-1492

CVE-2011-1492 affects Roundcube Webmail prior to 0.5.1. The issue is in steps/utils/modcss.inc, where requests for an external CSS stylesheet are not properly verified, allowing remote authenticated users to trigger arbitrary outbound TCP connections from the server and potentially obtain sensiti...

CVE-2012-4668

CVE-2012-4668 affects Roundcube Webmail (versions 0.8.1 and earlier). The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary script or HTML via the email signature field. The root cause is insufficient sanitization/exposure of the email signature i...

CVE-2013-5645

CVE-2013-5645 pertains to multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before version 0.9.3. The issues allow user-assisted remote attackers to inject arbitrary script/HTML via the body of a message viewed in new or draft mode (compose.inc) and may also enable injectio...

CVE-2015-8105

CVE-2015-8105 affects Roundcube webmail, specifically the vulnerable component is program/js/app.js. The XSS flaw arises in the drag-and-drop file upload via the filename field, impacting Roundcube versions before 1.0.7 and 1.1.x before 1.1.3. Exploitation requires remote authenticated access, en...

CVE-2007-6321

The CVE-2007-6321 issue affects Roundcube webmail (0.1rc2 and earlier) where IE could execute XSS via style sheets containing expression commands. Connected OpenVAS/Nessus entries reference Fedora updates (FEDORA-2008-5333/5342/5315) that include XSS fixes for roundcubemail, indicating a patch-ba...

CVE-2026-35543

The CVE affects Roundcube Webmail versions before 1.5.14 and 1.6.14. The issue allows bypassing the remote image blocking feature via SVG content (with animate attributes) in an e-mail message, which can lead to information disclosure or an access-control bypass. Remediation details documented in...

CVE-2009-4077

CVE-2009-4077 : Cross-site request forgery (CSRF) in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack authentication of unspecified users for requests that send arbitrary emails via unspecified vectors. The issue affects Roundcube Webmail up to version 0.2.2; Fedora advisorie...

CVE-2026-35542

CVE-2026-35542 affects Roundcube Webmail prior to 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed by a crafted background attribute of a BODY element in an email, potentially leading to information disclosure or an access-control bypass. No exploitation details are provided i...

CVE-2026-35544

CVE-2026-35544 affects Roundcube Webmail before 1.5.14 and 1.6.14. The issue is insufficient CSS sanitization in HTML emails, which may allow a fixed-position mitigation bypass via the use of !important. CVSS v3.1 base score 5.3 (Network, Low complexity, No privileges, No user interaction). The d...

CVE-2008-5620

CVE-2008-5620 affects RoundCube Webmail (roundcubemail) prior to 0.2-beta. The vulnerability allows remote attackers to cause a denial of service via crafted size parameters used to generate a quota image, leading to memory consumption. Public references in the initial entry point to a DoS scenar...

CVE-2012-1253

CVE-2012-1253 is an XSS vulnerability in Roundcube Webmail before 0.7 where Internet Explorer handles an embedded image attachment; remote attackers could inject script or HTML. NVD lists a low base score (2.6, AV:N/AC:H/Au:N/I:P/A:N). Fedora/OpenVAS entries indicate Fedora advisories for roundcu...

CVE-2026-35539

CVE-2026-35539 affects Roundcube Webmail prior to 1.5.14 and 1.6.14. The issue is an XSS vulnerability caused by insufficient HTML attachment sanitization in preview mode; a user must preview a text/html attachment for exploitation. The vulnerability is limited to scenarios where a victim preview...

CVE-2025-68460

Roundcube Webmail is vulnerable to information disclosure in the HTML style sanitizer for releases before 1.5.12 and 1.6.x before 1.6.12. Multiple advisories (Debian DSA-6087, DLA-4415-1; Fedora packages roundcubemail 1.6.12; EUVD-2025-204036; NVD entry CVE-2025-68460) confirm the issue and point...

CVE-2026-75000

Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 fails to sanitize the SVG animate "by" attribute, allowing attackers to bypass remote image blocking and potentially disclose information or escalate privileges. Patches are available in releases 1.6.18 and 1.7.3. No active exploitation is re...

CVE-2013-5646

Roundcube webmail 1.0-git is affected by a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web script or HTML through the Name field of an addressbook group. The linked sources consistently describe XSS in this component/version, but do not prov...

CVE-2026-75010

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the password plugin's modoboa driver can leak a Modoboa API authentication token to a user-controlled host via crafted session data, affecting only instances using that driver. CVSS 3.1 score is 6.4 (Medium). Patches are available in 1.6....

CVE-2026-75003

CVE-2026-75003 affects Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 . Discovered by Milan Hoppe , the root cause is insufficient HTML/CSS sanitization of an unclosed url() in a FuncIRI attribute of an SVG image embedded in text/html emails. This allows evasion of the remote ima...

CVE-2026-75006

Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 has insufficient CSS sanitization in HTML emails, allowing SSRF or information disclosure when stylesheet links point to local network hosts; the flaw stems from incomplete fixes for CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643. Patches...

CVE-2026-75007

CVE-2026-75007 affects Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3. Milan Hoppe discovered that the LDAP search filter was subject to injection via unescaped %u/%fu/%d placeholder substitution, potentially leading to information disclosure or privilege escalation . The NVD assigns a CV...

CVE-2026-75004

In Roundcube Webmail, improper rule name quoting in the managesieve plugin allows a crafted Sieve rule name to bypass the managesieve_disabled_actions setting, letting users re-enable restricted Sieve actions (e.g., redirect, discard). Affects Roundcube <1.6.18 and 1.7.x