Login Request a demo
RW
Product
Roundcube Webmail
by Roundcube · last CVE Nov 19, 2021
On CISA KEVExploited in the wild
11
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 2High 3Medium 6Low 0
Severity
All severities11Critical2High3Medium6Low0
Exploitation
On CISA KEV4Exploited in the wild4
Watch

Add Roundcube Webmail to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-44026
In wildKEV
9.8
70%
Nov 19
Roundcube Webmail SQL Injection Vulnerability
Affected: All versions, or not specified
CVE-2020-12641
In wildKEV
9.8
84%
May 4
Roundcube Webmail Remote Code Execution Vulnerability
Affected: All versions, or not specified
CVE-2017-16651
In wildKEV
7.8
46%
Nov 9
Roundcube Webmail File Disclosure Vulnerability
Affected: All versions, or not specified
CVE-2020-35730
In wildKEV
6.1
33%
Dec 28
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
Affected: All versions, or not specified
CVE-2015-5383
7.5
4%
May 23
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory
Affected: 1.1.1
CVE-2015-8770
7.5
22%
Jan 29
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated…
Affected: through 1.0.7; 1.1.0; 1.1.1; 1.1.2; 1.1.3
CVE-2015-5382
6.5
3%
May 23
program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when…
Affected: through 1.0.5; 1.1.1
CVE-2015-8794
6.5
2%
Jan 29
Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary…
Affected: through 1.0.5; 1.1.0; 1.1.1
CVE-2015-5381
6.1
3%
May 23
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via…
Affected: 1.1.1
CVE-2016-4068
6.1
3%
Apr 13
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG,…
Affected: 1.1.1; 1.1.2; 1.1.3
CVE-2015-8864
6.1
3%
Apr 13
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG,…
Affected: 1.1.1; 1.1.2; 1.1.3
Showing 11