Roundcube Roundcube

  1. Vendors
  2. Roundcube
Do you want an email whenever new security vulnerabilities are reported in any Roundcube product?

Products by Roundcube Sorted by Most Security Vulnerabilities since 2018

Roundcube Webmail26 vulnerabilities

Roundcube7 vulnerabilities

Known Exploited Roundcube Vulnerabilities

The following Roundcube vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title Description Added
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages. CVE-2023-43770 February 12, 2024
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code. CVE-2023-5631 October 26, 2023
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php. CVE-2020-35730 June 22, 2023
Roundcube Webmail Remote Code Execution Vulnerability Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. CVE-2020-12641 June 22, 2023
Roundcube Webmail SQL Injection Vulnerability Roundcube Webmail is vulnerable to SQL injection via search or search_params. CVE-2021-44026 June 22, 2023
Roundcube Webmail File Disclosure Vulnerability Allows unauthorized access to arbitrary files on the host's filesystem, including configuration files. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests. CVE-2017-16651 November 3, 2021

By the Year

In 2024 there have been 0 vulnerabilities in Roundcube . Last year Roundcube had 3 security vulnerabilities published. Right now, Roundcube is on track to have less security vulnerabilities in 2024 than it did last year.

Year Vulnerabilities Average Score
2024 0 0.00
2023 3 5.87
2022 1 6.10
2021 5 6.42
2020 9 6.97
2019 2 5.85
2018 5 7.16

It may take a day or so for new Roundcube vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Roundcube Security Vulnerabilities

Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5

CVE-2023-47272 6.1 - Medium - November 06, 2023

Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).

XSS

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4

CVE-2023-5631 5.4 - Medium - October 18, 2023

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

XSS

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3

CVE-2023-43770 6.1 - Medium - September 22, 2023

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

XSS

Roundcube before 1.4.13 and 1.5.x before 1.5.2

CVE-2021-46144 6.1 - Medium - January 06, 2022

Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.

XSS

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection

CVE-2021-44026 9.8 - Critical - November 19, 2021

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

SQL Injection

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.

CVE-2021-44025 6.1 - Medium - November 19, 2021

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.

XSS

Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4

CVE-2020-18671 5.4 - Medium - June 24, 2021

Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.

XSS

Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4

CVE-2020-18670 5.4 - Medium - June 24, 2021

Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.

XSS

Roundcube before 1.4.11

CVE-2021-26925 5.4 - Medium - February 09, 2021

Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.

XSS

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10

CVE-2020-35730 6.1 - Medium - December 28, 2020

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

XSS

Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document

CVE-2020-16145 6.1 - Medium - August 12, 2020

Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.

XSS

An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7

CVE-2020-15562 6.1 - Medium - July 06, 2020

An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.

XSS

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5

CVE-2020-13964 6.1 - Medium - June 09, 2020

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.

XSS

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5

CVE-2020-13965 6.1 - Medium - June 09, 2020

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

XSS

Roundcube Webmail before 1.4.4

CVE-2020-12640 9.8 - Critical - May 04, 2020

Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.

Directory traversal

rcube_image.php in Roundcube Webmail before 1.4.4

CVE-2020-12641 9.8 - Critical - May 04, 2020

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

Shell injection

An issue was discovered in Roundcube Webmail before 1.4.4

CVE-2020-12625 6.1 - Medium - May 04, 2020

An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.

XSS

An issue was discovered in Roundcube Webmail before 1.4.4

CVE-2020-12626 6.5 - Medium - May 04, 2020

An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.

Session Riding

Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names

CVE-2019-15237 7.4 - High - August 20, 2019

Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.

In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails

CVE-2019-10740 4.3 - Medium - April 07, 2019

In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.

Cleartext Transmission of Sensitive Information

Built by Foundeo Inc., with data from the National Vulnerability Database (NVD), Icons by Icons8. Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.