WE
Product
Webmail
On CISA KEVExploited in the wild
126
CVEs
11
On KEV
10.0
Max CVSS
20
New 30D
Severity mix
Critical 10High 29Medium 58Low 5
Watch
Add Webmail to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-114721 New | 3.1 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed Affected: 1.6.0 before 1.6.20; 1.7.0 before 1.7.5 |
| CVE-2026-35538 | 3.1 | Apr 3 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14 Affected: before 1.5.14; 1.6.0 before 1.6.14 |
| CVE-2015-8105 | – | Nov 10 | Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web… Affected: through 1.0.6; 1.1.0; 1.1.1; 1.1.2 |
| CVE-2015-1433 | – | Feb 3 | program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via… Affected: through 1.0.4 |
| CVE-2014-9587 | – | Jan 15 | Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown… Affected: through 1.0.3 |
| CVE-2013-1904 | – | Feb 8 | Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a… Affected: through 0.7.2; 0.1; 0.1; 0.1; 0.1; 0.1; +34 more |
| CVE-2013-6172 | – | Nov 5 | steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can… Affected: through 0.8.6; 0.1; 0.1; 0.1; 0.1; 0.1; +34 more |
| CVE-2013-5646 | – | Aug 29 | Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook… Affected: 1.0 |
| CVE-2013-5645 | – | Aug 29 | Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a… Affected: through 0.9.2; 0.1; 0.1; 0.1; 0.1; 0.1; +34 more |
| CVE-2012-6121 | – | Feb 24 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link Affected: through 0.8.4; 0.1; 0.1; 0.1; 0.1; 0.1; +32 more |
| CVE-2012-4668 | – | Aug 25 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email Affected: through 0.8.1; 0.1; 0.1; 0.1; 0.1; 0.1; +28 more |
| CVE-2012-3508 | – | Aug 25 | Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using… Affected: 0.8.0 |
| CVE-2012-3507 | – | Aug 25 | Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary… Affected: through 0.7.3; 0.1; 0.1; 0.1; 0.1; 0.1; +33 more |
| CVE-2012-1253 | – | Jun 4 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via… Affected: through 0.6; 0.1; 0.1; 0.1; 0.1; 0.1; +22 more |
| CVE-2011-4078 | – | Nov 3 | include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a… Affected: through 0.5.4; 0.1; 0.1; 0.1; 0.1; 0.1; +20 more |
| CVE-2011-2937 | – | Sep 21 | Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the… Affected: through 0.5.3; 0.1; 0.1; 0.1; 0.1; 0.1; +19 more |
| CVE-2011-1491 | – | Apr 8 | The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated… Affected: through 0.5; 0.1; 0.1; 0.1; 0.1; 0.1; +16 more |
| CVE-2011-1492 | – | Apr 8 | steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet,… Affected: through 0.5; 0.1; 0.1; 0.1; 0.1; 0.1; +16 more |
| CVE-2010-0464 | – | Jan 29 | Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to… Affected: through 0.3.1; 0.1; 0.1; 0.1; 0.1; 0.1; +17 more |
| CVE-2009-4077 | – | Nov 25 | Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that… Affected: through 0.2.2; 0.1; 0.1; 0.1; 0.1; 0.1; +12 more |
| CVE-2009-4076 | – | Nov 25 | Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that… Affected: through 0.2.2; 0.1; 0.1; 0.1; 0.1; 0.1; +12 more |
| CVE-2009-0413 | – | Feb 3 | Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background… Affected: 0.2 |
| CVE-2008-5620 | – | Dec 17 | RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a… Affected: through 0.2; 0.1; 0.1; 0.1; 0.1; 0.1; +8 more |
| CVE-2008-5619 | – | Dec 17 | html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03,… Affected: 0.2.1; 0.2.3 |
| CVE-2007-6321 | – | Dec 12 | Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and earlier versions, when using Internet Explorer, allows remote attackers to inject arbitrary… Affected: through 0.1 |
| CVE-2005-4368 | – | Dec 20 | roundcube webmail Alpha, with a default high verbose level ($rcmail_config['debug_level'] = 1), allows remote attackers to obtain the full path of the application via an… Affected: All versions, or not specified |