CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2020-06-09
Roundcube Webmail Cross-Site Scripting (XSS) via Malicious XML Attachment (CVE-2020-13965)
[Affected Scope] Roundcube Webmail versions before 1.3.12 and 1.4.x before 1.4.5
[Impact] Attackers can execute arbitrary JavaScript in the victim's browser session via a malicious XML attachment preview, leading to session hijacking
[Mitigation] Immediately upgrade Roundcube Webmail to patched versions 1.3.12, 1.4.5, or later