Search for packages
| purl | pkg:deb/debian/roundcube@1.4.15%2Bdfsg.1-1%2Bdeb11u4?distro=trixie |
| Next non-vulnerable version | 1.4.15+dfsg.1-1+deb11u5 |
| Latest non-vulnerable version | 1.6.15+dfsg-1 |
| Risk | 3.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-rdb5-bbvn-7fcq
Aliases: CVE-2019-15237 |
Multiple vulnerabilities have been discovered in Roundcube, the worst of which could lead to execution of arbitrary code. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-14vp-t71a-4bh1 | security update |
CVE-2021-46144
|
| VCID-1aph-76b1-eyhv | Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI. |
CVE-2011-2937
|
| VCID-23v8-vzqs-j3f6 | program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard. |
CVE-2015-5382
|
| VCID-2eyy-k49d-m3af | Multiple vulnerabilities have been discovered in Roundcube, the worst of which could lead to execution of arbitrary code. |
CVE-2021-44026
|
| VCID-2hap-9mqs-v3b8 | Roundcube Webmail: Incorrect password comparison in the password plugin |
CVE-2026-35541
GHSA-46pv-mj2g-93gh |
| VCID-2k4q-26tk-j3gx | security update |
CVE-2024-42010
|
| VCID-2nb2-9vgp-tqg9 | roundcubemail: Roundcube Webmail: Information Disclosure via HTML Style Sanitizer |
CVE-2025-68460
|
| VCID-36et-26h7-pke7 | security update |
CVE-2024-42008
|
| VCID-3kyu-tx4q-p3aq | Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. |
CVE-2025-49113
GHSA-8j8w-wwqc-x596 |
| VCID-3rza-7fvy-guce | Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler |
CVE-2026-35537
GHSA-rxj3-rrwm-pj4r |
| VCID-489e-j7sj-5kgv | The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password. |
CVE-2015-2180
|
| VCID-4wpg-mwxc-pqhr | roundcubemail: privacy compromise via DNS prefetching in web mail |
CVE-2010-0464
|
| VCID-4yzj-hrqv-vbcp | Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage. |
CVE-2026-25916
|
| VCID-53mq-nmxf-eug3 | steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request. |
CVE-2011-1492
|
| VCID-5yts-xnha-4bf3 | Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode |
CVE-2026-35539
GHSA-x4q5-8j5g-hpjc |
| VCID-76t7-q4pa-gkct | Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI. |
CVE-2015-5381
|
| VCID-79me-pjdn-ykgq | A flaw in Roundcube's handling of configuration files may allow arbitrary code execution, amongst other vulnerabilities. |
CVE-2020-12640
|
| VCID-7hh1-8grz-7fa9 | include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379. |
CVE-2011-4078
|
| VCID-7nn6-aywu-z7g8 | security update |
CVE-2020-13964
|
| VCID-8keg-wbj1-8ua9 | The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message, related to a "login CSRF" issue. |
CVE-2011-1491
|
| VCID-8vmm-1hvf-17ap | Roundcube: Bypass of remote image blocking via crafted BODY background attribute |
CVE-2026-35542
GHSA-5hf6-crg4-fg59 |
| VCID-8xf2-hjfv-hybh | Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages |
CVE-2026-35544
GHSA-xpqh-grpw-4xmg |
| VCID-9der-5csu-nbbq | security update |
CVE-2024-42009
|
| VCID-9ktu-55q4-3kau | Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php. |
CVE-2018-19205
|
| VCID-9uqr-ph81-gfef | Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username. |
CVE-2015-2181
|
| VCID-9uv1-gqq7-3kc9 | roundcubemail: Roundcube Webmail: Cross-Site Scripting (XSS) vulnerability via crafted SVG animate tag |
CVE-2025-68461
|
| VCID-am6h-k37a-j3au | Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group. |
CVE-2013-5646
|
| VCID-brmp-djyb-q3b7 | Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors. |
CVE-2016-4069
|
| VCID-c196-941x-8kfj | Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013. |
CVE-2013-1904
|
| VCID-c4ys-1wzp-vqej | A vulnerability in RoundCube may allow authenticated users to bypass security restrictions. |
CVE-2017-8114
|
| VCID-cjkd-2jr6-n7as | roundcubemail: allows XSS via SVG animate attributes |
CVE-2024-37383
|
| VCID-ck88-1urs-2kes | Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message |
CVE-2026-35543
GHSA-j2g6-8rvg-7mf6 |
| VCID-cnkc-vcp7-6kcw | A flaw in Roundcube's handling of configuration files may allow arbitrary code execution, amongst other vulnerabilities. |
CVE-2020-12626
|
| VCID-cqkb-9pzc-skf1 | Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject. |
CVE-2012-3507
|
| VCID-ddfq-28qm-2fbn | Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message |
CVE-2026-35545
GHSA-w846-74jr-76cv |
| VCID-dska-q14x-sqfr | roundcubemail: DoS due insufficient quota image size paramaters checking (use excessive amount of memory) |
CVE-2008-5620
|
| VCID-dzu5-531f-qqgy | program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email. |
CVE-2015-1433
|
| VCID-eewu-36xn-myf9 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641. |
CVE-2024-37385
|
| VCID-ekhg-mmjb-v3c3 | A vulnerability in Roundcube could potentially lead to arbitrary code execution. |
CVE-2016-9920
|
| VCID-fuh5-bwaq-yyfk | security update |
CVE-2017-16651
|
| VCID-g7dn-kxs3-p7bx | Multiple vulnerabilities have been found in Roundcube allowing remote authenticated users to execute arbitrary code, inject arbitrary web scripts, and perform cross-site scripting (XSS). |
CVE-2015-8770
|
| VCID-gh6k-19h8-fqbf | Roundcube Webmail: Unsanitized IMAP SEARCH command arguments |
CVE-2026-35538
GHSA-8jr8-v43g-5c57 |
| VCID-hg1a-vx5c-hue3 | A flaw in Roundcube's handling of configuration files may allow arbitrary code execution, amongst other vulnerabilities. |
CVE-2020-12641
|
| VCID-j29t-cw2h-mfd8 | roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity. |
CVE-2018-1000071
|
| VCID-ja7n-zgpp-dfh4 | A vulnerability in Roundcube could result in arbitrary code execution, SQL injection, or reading of arbitrary files. |
CVE-2013-6172
|
| VCID-jck5-xymf-s3bh | security update |
CVE-2020-16145
|
| VCID-jkut-q94f-sbd5 | roundcube webmail Alpha, with a default high verbose level ($rcmail_config['debug_level'] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message. |
CVE-2005-4368
|
| VCID-jqs5-8ct7-wfgk | Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. |
CVE-2021-26925
|
| VCID-kch8-wrzv-bfdm | Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email. |
CVE-2012-4668
|
| VCID-kep3-256k-fqdm | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment. |
CVE-2012-1253
|
| VCID-kf54-x29g-63fb | Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling. |
CVE-2015-8794
|
| VCID-kyxz-v3sj-w3cw | Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php. |
CVE-2020-18671
|
| VCID-m4yc-ms54-zyhv | security update |
CVE-2020-13965
|
| VCID-n13m-y4ks-euep | Improper Control of Generation of Code ('Code Injection') html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch. |
CVE-2008-5619
GHSA-v5c9-mmw9-829q |
| VCID-ncbg-6m11-3qan | security update |
CVE-2023-47272
|
| VCID-nsmn-bdjj-ffbx | Webmail: Multiple CSRF flaws |
CVE-2009-4076
|
| VCID-p1fk-9wdh-83ae | Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory. |
CVE-2015-5383
|
| VCID-q1v9-tt8f-k3hp | roundcubemail: Remotely exploitable web script or HTML code injection vulnerability via the background attribute embedded in an HTML e-mail message (XSS) |
CVE-2009-0413
|
| VCID-q7hf-9w59-n3an | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link. |
CVE-2012-6121
|
| VCID-qfyq-umv5-e7h1 | Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email. |
CVE-2012-3508
|
| VCID-qr2m-f4yw-qqa5 | Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc. |
CVE-2013-5645
|
| VCID-qwak-6wgy-wfgs | security update |
CVE-2024-37384
|
| VCID-r1hb-f5nm-ykhk | Multiple vulnerabilities have been found in Roundcube allowing remote authenticated users to execute arbitrary code, inject arbitrary web scripts, and perform cross-site scripting (XSS). |
CVE-2015-8105
|
| VCID-r64m-rd3v-ekbu | roundcubemail: XSS vulnerability |
CVE-2007-6321
|
| VCID-rc91-j3kf-zfch | security update |
CVE-2020-15562
|
| VCID-rthq-fqk2-yydk | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864. |
CVE-2016-4068
|
| VCID-s6p1-rf35-euhy | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. |
CVE-2023-43770
|
| VCID-spk8-q616-rkda | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068. |
CVE-2015-8864
|
| VCID-tmch-gj6d-tyfq | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message. |
CVE-2016-4552
|
| VCID-ts1p-pw9v-cbh3 | security update |
CVE-2018-19206
|
| VCID-u8a4-4pe2-9kcb | security update |
CVE-2020-35730
|
| VCID-ub6x-9dku-c7fk | Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages |
CVE-2026-35540
GHSA-vxg2-hhgr-37fx |
| VCID-ur1a-7tdn-h3hu | In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker. |
CVE-2019-10740
|
| VCID-vehj-ytsm-kqgz | security update |
CVE-2023-5631
|
| VCID-vtz8-zmp4-xbdh | roundcubemail: Roundcube Webmail: Cascading Style Sheets (CSS) injection via mishandled comments |
CVE-2026-26079
|
| VCID-x9j7-98zt-6ygt | A flaw in Roundcube's handling of configuration files may allow arbitrary code execution, amongst other vulnerabilities. |
CVE-2020-12625
|
| VCID-xssa-fwbx-kybq | Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php. |
CVE-2020-18670
|
| VCID-y12r-rry9-ckhm | Webmail: Multiple CSRF flaws |
CVE-2009-4077
|
| VCID-ybv7-hqmj-nbgr | Multiple vulnerabilities have been discovered in Roundcube, the worst of which could lead to execution of arbitrary code. |
CVE-2021-44025
|
| VCID-yerh-ssat-abah | rcube_utils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element. |
CVE-2017-6820
|
| VCID-yv5x-shsw-57cv | Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins. |
CVE-2014-9587
|
| VCID-z3kp-p8ch-myhz | security update |
CVE-2018-9846
|
| VCID-z7fn-ubfx-g3em | Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter in a mail task to the default URL, a different vulnerability than CVE-2011-2937. |
CVE-2015-8793
|