Skip to content
OpenAdvisories

Package · Debian

roundcube

123 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.9
    CVE-2025-49113 Exploited Public exploit EPSS 100%

    Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

    Roundcube Webmail roundcube roundcube Debian Ubuntu Packagist
    KEV Feb 20, 2026
  • Critical 9.3
    CVE-2024-42008 Public exploit EPSS 34%

    A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.…

    roundcube roundcube Debian Ubuntu
  • Critical 9.3
    CVE-2024-42009 Exploited Public exploit EPSS 83%

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to ste…

    roundcube roundcube Debian Ubuntu
    KEV Jun 9, 2025
  • Critical 9.8
    CVE-2021-44026 Exploited Public exploit EPSS 70%

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023
  • Critical 9.8
    CVE-2020-12641 Exploited Public exploit EPSS 84%

    rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters i…

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023