Skip to content
Noroxi

Roundcube records

117 published records for vendor Roundcube. 11 of them have been exploited in the wild (listed in CISA KEV) and 11 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
11 · 9.4%
Weaponized
11 · 9.4%
Pre-auth RCE
4
With a fix record
94.9%
Median publish → KEV
308 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 25
  11. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

117 records
  • CVE-2025-49113
    95Now

    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    roundcube · webmailJun 2, 2025

  • CVE-2020-12641
    94Now

    rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration set

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    roundcube · webmailMay 4, 2020

  • CVE-2024-42009
    92Now

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of

    CriticalCVSS 9.3KEVWeaponizedEPSS 82%

    roundcube · webmailAug 5, 2024

  • CVE-2021-44026
    90Now

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    CriticalCVSS 9.8KEVWeaponizedEPSS 69%

    roundcube · webmailNov 19, 2021

  • CVE-2020-13965
    77This week

    An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.

    MediumCVSS 6.1KEVWeaponizedEPSS 76%

    roundcube · webmailJun 8, 2020

  • CVE-2024-37383
    76This week

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

    MediumCVSS 6.1KEVWeaponizedEPSS 73%

    roundcube · webmailJun 7, 2024

  • CVE-2017-16651
    75This week

    Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's file

    HighCVSS 7.8KEVWeaponizedEPSS 45%

    roundcube · webmailNov 9, 2017

  • CVE-2023-5631
    74This week

    Stored XSS vulnerability in Roundcube

    MediumCVSS 5.4KEVWeaponizedEPSS 76%

    roundcube · webmailOct 18, 2023

  • CVE-2023-43770
    73This week

    Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of

    MediumCVSS 6.1KEVWeaponizedEPSS 63%

    roundcube · webmailSep 22, 2023

  • CVE-2020-35730
    64This week

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10.

    MediumCVSS 6.1KEVWeaponizedEPSS 32%

    roundcube · webmailDec 28, 2020

  • CVE-2025-68461
    62This week

    Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG d

    MediumCVSS 6.1KEVWeaponizedEPSS 27%

    roundcube · webmailDec 18, 2025

  • CVE-2008-5619
    58Plan

    html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2

    CriticalCVSS 10.0Proof of conceptEPSS 58%

    roundcube · webmailDec 16, 2008

  • CVE-2024-42010
    50Plan

    mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in ren

    HighCVSS 7.5No exploitEPSS 66%

    Aug 5, 2024

  • CVE-2024-42008
    47Plan

    A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote att

    CriticalCVSS 9.3Proof of conceptEPSS 33%

    roundcube · webmailAug 5, 2024

  • CVE-2018-19206
    41Plan

    steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY elem

    MediumCVSS 6.1No exploitEPSS 55%

    roundcube · webmailNov 12, 2018

  • CVE-2020-12640
    41Plan

    Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_pl

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    roundcube · webmailMay 4, 2020

  • CVE-2026-54433
    40Plan

    In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    roundcube · webmailJul 14, 2026

  • CVE-2026-62643
    40Plan

    In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages ma

    CriticalCVSS 10.0No exploitEPSS 0%

    roundcube · webmailJul 14, 2026

  • CVE-2024-37385
    39Monitor

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path.

    CriticalCVSS 9.8No exploitEPSS 1%

    roundcube · webmailJun 7, 2024

  • CVE-2026-75003
    39Monitor

    In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote i

    CriticalCVSS 9.8No exploitEPSS 0%

    roundcube · webmailAug 17, 2026

  • CVE-2026-62644
    39Monitor

    In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via

    CriticalCVSS 9.8No exploitEPSS 0%

    roundcube · webmailJul 14, 2026

  • CVE-2015-8770
    37Monitor

    Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x bef

    HighCVSS 7.5Proof of conceptEPSS 22%

    roundcube · roundcube webmailJan 29, 2016

  • CVE-2024-57004
    36Monitor

    Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email

    MediumCVSS 6.1No exploitEPSS 40%

    roundcube · webmailFeb 3, 2025

  • CVE-2015-2180
    36Monitor

    The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metachara

    HighCVSS 8.8No exploitEPSS 4%

    roundcube · webmailJan 30, 2017

  • CVE-2017-8114
    36Monitor

    Roundcube Webmail allows arbitrary password resets by authenticated users.

    HighCVSS 8.8No exploitEPSS 3%

    roundcube · webmailApr 29, 2017