Unscored severity · published Aug 25, 2012
CVE-2012-3507
Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmail · Roundcube
through 0.7.3; 0.1; 0.1; 0.1; 0.1; 0.1; +33 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3507
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3507
Vendor Advisory
http://secunia.com/advisories/50212
sourceforge.net
http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.0/
Exploit
http://trac.roundcube.net/ticket/1488519
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/08/20/2
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/08/20/3
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/08/20/9
More from Webmail
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.3
CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
8.8
CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
7.8
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability