CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Roundcube Webmail SVG animate Tag Cross-Site Scripting (XSS) Vulnerability (CVE-2025-68461) Security Advisory
[Affected Scope] Roundcube Webmail versions before 1.5.12 and 1.6.x versions before 1.6.12
[Impact] Remote attackers can execute arbitrary JavaScript code in the context of the victim's browser session via a malicious SVG attachment, leading to session hijacking and unauthorized email access
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions 1.5.12 or 1.6.12
Roundcube Webmail SVG animate Attribute Bypass Cross-Site Scripting (XSS) Vulnerability (CVE-2024-37383) Analysis and Mitigation Guide
[Affected Scope] Roundcube Webmail versions prior to 1.5.7 and 1.6.x versions prior to 1.6.7
[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted email containing malicious SVG animate attributes, leading to session hijacking
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.7, 1.6.7, or later)