Skip to content
OpenAdvisories

Vendor

Roundcube

59 known vulnerabilities.

Products

Webmail 58 Roundcubemail 1 roundcube 0
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.2
    CVE-2025-68461 Exploited Public exploit EPSS 27%

    Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the an…

    Roundcube Webmail roundcube roundcube Debian Ubuntu
    KEV Feb 20, 2026
  • Critical 9.9
    CVE-2025-49113 Exploited Public exploit EPSS 100%

    Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

    Roundcube Webmail roundcube roundcube Debian Ubuntu Packagist
    KEV Feb 20, 2026
  • Medium 6.1
    CVE-2023-5631 Exploited EPSS 76%

    Stored XSS vulnerability in Roundcube

    Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary Java…

    Roundcube Roundcubemail roundcube roundcube Debian Ubuntu
    KEV Oct 26, 2023