CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Roundcube Webmail PHP Object Deserialization Remote Code Execution Vulnerability Advisory (CVE-2025-49113)
[Affected Scope] Roundcube Webmail versions before 1.5.10 and 1.6.x versions before 1.6.11
[Impact] Authenticated remote attackers can trigger PHP Object Deserialization via the manipulated _from parameter, leading to arbitrary Remote Code Execution (RCE) on the host server
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.10, 1.6.11, or later)
Roundcube Webmail Stored Cross-Site Scripting (XSS) Vulnerability Leading to Email Theft Advisory (CVE-2024-42009)
[Affected Scope] Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7
[Impact] A remote attacker can execute malicious scripts in the victim's browser session by sending a crafted email, enabling unauthorized access, theft, and transmission of the victim's emails.
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.8, 1.6.8, or later).
Roundcube Webmail SQL Injection Vulnerability Security Advisory (CVE-2021-44026)
[Affected Scope] Roundcube versions before 1.3.17 and 1.4.x versions before 1.4.12
[Impact] Unauthenticated attackers can manipulate search parameters to extract sensitive database information or potentially achieve remote code execution (RCE)
[Mitigation] Immediately upgrade Roundcube to the latest stable releases (1.3.17, 1.4.12, or higher)
Roundcube Webmail rcube_image.php Remote Code Execution Vulnerability (CVE-2020-12641)
[Affected Scope] Roundcube Webmail versions before 1.4.4
[Impact] Unauthenticated attackers can execute arbitrary OS commands and gain full control of the mail server via shell metacharacters
[Mitigation] Immediately upgrade Roundcube Webmail to version 1.4.4 or later and restrict ImageMagick configuration paths