Webmail

webmail

Vendor: Roundcube • 95 CVEs

CVEs (95)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-35540 1Roundcube 1Webmail Jul 24, 2026 Apr 3, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point...Show more An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.Show less
CVE-2026-35539 1Roundcube 1Webmail Jul 24, 2026 Apr 3, 2026 N/A· v4 6.1 MEDIUM· v3 N/A· v2 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
CVE-2026-35538 1Roundcube 1Webmail Jul 24, 2026 Apr 3, 2026 N/A· v4 3.1 LOW· v3 N/A· v2 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
CVE-2026-35537 1Roundcube 1Webmail Jul 24, 2026 Apr 3, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted ses...Show more An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.Show less
CVE-2025-68461 1Roundcube 1Webmail Jun 17, 2026 Dec 18, 2025 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVE-2025-68460 1Roundcube 1Webmail Jun 17, 2026 Dec 18, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.
CVE-2025-49113 2Debian Roundcube 2Debian Linux Webmail Jun 17, 2026 Jun 2, 2025 N/A· v4 8.8 HIGH· v3 N/A· v2 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Obj...Show more Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.Show less
CVE-2024-57004 1Roundcube 1Webmail Jun 17, 2026 Feb 3, 2025 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.
CVE-2024-42009 1Roundcube 1Webmail Jun 17, 2026 Aug 5, 2024 N/A· v4 9.3 CRITICAL· v3 N/A· v2 A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in mes...Show more A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.Show less
CVE-2024-42008 1Roundcube 1Webmail Jun 17, 2026 Aug 5, 2024 N/A· v4 9.3 CRITICAL· v3 N/A· v2 A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment ser...Show more A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.Show less
CVE-2024-37385 1Roundcube 1Webmail Jun 17, 2026 Jun 7, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.
CVE-2024-37384 2Debian Roundcube 2Debian Linux Webmail Jun 17, 2026 Jun 7, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
CVE-2024-37383 2Debian Roundcube 2Debian Linux Webmail Jun 17, 2026 Jun 7, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
CVE-2023-47272 3Debian FedoraprojectRoundcube 3Debian Linux FedoraWebmail Jun 17, 2026 Nov 6, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
CVE-2023-5631 3Debian FedoraprojectRoundcube 3Debian Linux FedoraWebmail Jun 17, 2026 Oct 18, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a...Show more Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.Show less
CVE-2023-43770 2Debian Roundcube 2Debian Linux Webmail Jun 17, 2026 Sep 22, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
CVE-2021-44026 3Debian FedoraprojectRoundcube 3Debian Linux FedoraWebmail Jun 17, 2026 Nov 19, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
CVE-2021-44025 3Debian FedoraprojectRoundcube 3Debian Linux FedoraWebmail Jun 17, 2026 Nov 19, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
CVE-2020-18671 1Roundcube 1Webmail Jun 17, 2026 Jun 24, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
CVE-2020-18670 1Roundcube 1Webmail Jun 17, 2026 Jun 24, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.

Previous 123 4 5 Next