CVE-2023-5631

CVE-2023-5631 affects Roundcube Webmail. The issue is a stored XSS via an HTML e-mail message containing a crafted SVG, caused by logic in Roundcube’s rcube_washtml.php. Affected versions are Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4. Successful exploitation could allow ...

CVE-2023-43770

Roundcube Webmail vulnerability CVE-2023-43770 is a cross-site scripting (XSS) issue in Roundcube prior to 1.4.14, 1.5.x prior to 1.5.4, and 1.6.x prior to 1.6.3. The root cause is behavior in program/lib/Roundcube/rcube_string_replacer.php that allows XSS via crafted links in text/plain emails, ...

CVE-2023-47272

CVE-2023-47272 affects Roundcube Webmail (1.5.x before 1.5.6 and 1.6.x before 1.6.5). The underlying issue is improper handling of header values (Content-Type/Content-Disposition) when processing attachments, enabling a cross-site scripting (XSS) vulnerability via attachment preview or download. ...