CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Roundcube Webmail PHP Object Deserialization Remote Code Execution Vulnerability Advisory (CVE-2025-49113)
[Affected Scope] Roundcube Webmail versions before 1.5.10 and 1.6.x versions before 1.6.11
[Impact] Authenticated remote attackers can trigger PHP Object Deserialization via the manipulated _from parameter, leading to arbitrary Remote Code Execution (RCE) on the host server
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.10, 1.6.11, or later)
Roundcube Webmail Stored Cross-Site Scripting (XSS) Vulnerability Leading to Email Theft Advisory (CVE-2024-42009)
[Affected Scope] Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7
[Impact] A remote attacker can execute malicious scripts in the victim's browser session by sending a crafted email, enabling unauthorized access, theft, and transmission of the victim's emails.
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.8, 1.6.8, or later).