CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Roundcube Webmail SVG animate Tag Cross-Site Scripting (XSS) Vulnerability (CVE-2025-68461) Security Advisory
[Affected Scope] Roundcube Webmail versions before 1.5.12 and 1.6.x versions before 1.6.12
[Impact] Remote attackers can execute arbitrary JavaScript code in the context of the victim's browser session via a malicious SVG attachment, leading to session hijacking and unauthorized email access
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions 1.5.12 or 1.6.12
Roundcube Webmail PHP Object Deserialization Remote Code Execution Vulnerability Advisory (CVE-2025-49113)
[Affected Scope] Roundcube Webmail versions before 1.5.10 and 1.6.x versions before 1.6.11
[Impact] Authenticated remote attackers can trigger PHP Object Deserialization via the manipulated _from parameter, leading to arbitrary Remote Code Execution (RCE) on the host server
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.10, 1.6.11, or later)
Roundcube Webmail Stored Cross-Site Scripting (XSS) Vulnerability Leading to Email Theft Advisory (CVE-2024-42009)
[Affected Scope] Roundcube Webmail versions through 1.5.7 and 1.6.x through 1.6.7
[Impact] A remote attacker can execute malicious scripts in the victim's browser session by sending a crafted email, enabling unauthorized access, theft, and transmission of the victim's emails.
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.8, 1.6.8, or later).
Roundcube Webmail SVG animate Attribute Bypass Cross-Site Scripting (XSS) Vulnerability (CVE-2024-37383) Analysis and Mitigation Guide
[Affected Scope] Roundcube Webmail versions prior to 1.5.7 and 1.6.x versions prior to 1.6.7
[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted email containing malicious SVG animate attributes, leading to session hijacking
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.5.7, 1.6.7, or later)
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability via Plain Text Email Link Processing (CVE-2023-43770)
[Affected Scope] Roundcube Webmail versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3
[Impact] Remote attackers can execute arbitrary JavaScript code in the victim's browser session by sending a crafted text/plain email, potentially leading to session hijacking and account takeover
[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions (1.4.14, 1.5.4, 1.6.3, or later) and enforce strict Content Security Policies
Roundcube Webmail Cross-Site Scripting (XSS) via Malicious XML Attachment (CVE-2020-13965)
[Affected Scope] Roundcube Webmail versions before 1.3.12 and 1.4.x before 1.4.5
[Impact] Attackers can execute arbitrary JavaScript in the victim's browser session via a malicious XML attachment preview, leading to session hijacking
[Mitigation] Immediately upgrade Roundcube Webmail to patched versions 1.3.12, 1.4.5, or later