RW
Product
Roundcube Webmail
On CISA KEVExploited in the wild
13
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 3Medium 7Low 0
Watch
Add Roundcube Webmail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-44026 In wildKEV | 9.8 | Nov 19 | Roundcube Webmail SQL Injection Vulnerability Affected: All versions, or not specified |
| CVE-2020-12641 In wildKEV | 9.8 | May 4 | Roundcube Webmail Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2017-16651 In wildKEV | 7.8 | Nov 9 | Roundcube Webmail File Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2020-35730 In wildKEV | 6.1 | Dec 28 | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Affected: All versions, or not specified |
| CVE-2024-37385 | 9.8 | Jun 7 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path Affected: before 1.5.7; 1.6.0 before 1.6.7 |
| CVE-2015-5383 | 7.5 | May 23 | Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory Affected: 1.1.1 |
| CVE-2015-8770 | 7.5 | Jan 29 | Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated… Affected: through 1.0.7; 1.1.0; 1.1.1; 1.1.2; 1.1.3 |
| CVE-2015-5382 | 6.5 | May 23 | program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when… Affected: through 1.0.5; 1.1.1 |
| CVE-2015-8794 | 6.5 | Jan 29 | Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary… Affected: through 1.0.5; 1.1.0; 1.1.1 |
| CVE-2024-37384 | 6.1 | Jun 7 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences Affected: before 1.5.7; 1.6.x before 1.6.7 |
| CVE-2015-5381 | 6.1 | May 23 | Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via… Affected: 1.1.1 |
| CVE-2016-4068 | 6.1 | Apr 13 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG,… Affected: 1.1.1; 1.1.2; 1.1.3 |
| CVE-2015-8864 | 6.1 | Apr 13 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG,… Affected: 1.1.1; 1.1.2; 1.1.3 |
Showing 13