Unscored severity · published Aug 25, 2012
CVE-2012-4668
Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email
–
CVSS
3.7%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmail · Roundcube
through 0.8.1; 0.1; 0.1; 0.1; 0.1; 0.1; +28 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4668
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4668
sourceforge.net
http://sourceforge.net/news/?group_id=139281&id=309011
trac.roundcube.net
http://trac.roundcube.net/ticket/1488613
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/08/20/2
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/08/20/9
Patch
https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32
More from Webmail
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.3
CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
8.8
CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
7.8
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability