Roundcube

Records129All Threatist records

Exploited (KEV)11In CISA KEV

CVSS critical12CVSS 9.0–10.0

CVSS high34CVSS 7.0–8.9

Exploited now

Roundcube records in CISA KEV

TI-2025-31204 RoundCube Webmail Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2026-02-20 TI-2025-41994 RoundCube Webmail Cross-site Scripting Vulnerability CRITICAL 91KEV 2026-02-20 TI-2024-28025 RoundCube Webmail Cross-Site Scripting Vulnerability CRITICAL 99KEV 2025-06-09 TI-2024-24889 RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability HIGH 84KEV 2024-10-24 TI-2020-10941 Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability CRITICAL 85KEV 2024-06-26 TI-2023-23468 Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability HIGH 84KEV 2024-02-12

Components

Products in the NVD configurations · select one to filter the records

Webmail 113 records CRITICAL Roundcube Webmail 7 records MEDIUM Roundcube 1 record LOW

Records

7 records in Roundcube Webmail · all components

TI-2015-07219 CVE-2015-8770 · GHSA-xc26-wfvp-2xpj

Directory traversal vulnerability in the set_skin function in…

MEDIUM 53

Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arb…

CVSS 3.0HIGH 7.5 Network Low privileges No interaction EPSS 0.22425 Published 2016-01-29 No fix listed CWE-22

TI-2015-04536 CVE-2015-5383 · GHSA-h6p8-6wgc-vh4r

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive…

LOW 39

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03828 Published 2017-05-23 No fix listed CWE-200

TI-2015-04535 CVE-2015-5382 · GHSA-w7xj-f8mh-628v

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before…

LOW 34

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02925 Published 2017-05-23 No fix listed CWE-200

TI-2015-07240 CVE-2015-8794 · GHSA-fv6h-3g7x-x6v7

Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube…

LOW 33

Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt para…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02119 Published 2016-01-29 No fix listed CWE-22

TI-2016-03457 CVE-2016-4068 · GHSA-4rqp-f36w-28hw

Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x…

LOW 32

Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02501 Published 2017-04-13 No fix listed CWE-79

TI-2015-07294 CVE-2015-8864 · GHSA-69rv-gvqx-4x9h

Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x…

LOW 32

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02691 Published 2017-04-13 No fix listed CWE-79

TI-2015-04534 CVE-2015-5381 · GHSA-875m-3rwh-hhhp

Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube…

LOW 32

Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02702 Published 2017-05-23 No fix listed CWE-79

Open these records in search →