Sploitus

50 exploited vulnerabilities in Roundcube Webmail

Vulnerabilities with publicly known exploits

Vendors
Unknown, Alt Linux, Linux Mint, Suse, Canonical, Atmail
With known exploits
50
Affected Roundcube Webmail versions
< 1.6.17, 1.7.2, 0.2.1, 0.2.3, 1.5.10, 1.6.11, 1.2.10, 1.3.11, 1.4.4, 1.5.8, 1.6.8, 1.5.15, 1.6.15, 1.1.9, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.3.0, 1.3.1, 1.3.2, 1.5.12, 1.6.12, 1.5.7, 1.6.7, 1.3.12, 1.4.5, 1.2.13, 1.3.16, 1.4.10, 1.5.13, 1.6.13, 1.5.14, 1.6.14
Affected Iredmail versions
≤ 0.9.6

Vulnerabilities with exploits

Highest CVSS first — 14 of these already have exploit code on Sploitus

CVE-2026-54433
CVSS 10.0 CRITICAL 2026-07-09FIX AVAILABLE
CVE-2020-12641
CVSS 10.0 CRITICAL 2019-10-03FIX AVAILABLE
CVE-2008-5619 14 exploits
CVSS 10.0 HIGH 2008-12-17
RoundCube Webmail <= 0.2-3 beta Code Execution VulnerabilityRoundCube Webmail <= 0.2b Remote Code Execution Exploit
CVE-2025-49113 28 exploits
CVSS 9.9 CRITICAL 2019-11-09FIX AVAILABLE
Exploit for Deserialization of Untrusted Data in Roundcube WebmailExploit for Deserialization of Untrusted Data in Roundcube Webmail
CVE-2024-37385
CVSS 9.8 CRITICAL 2024-06-06FIX AVAILABLE
CVE-2020-12640
CVSS 9.8 CRITICAL 2019-10-03FIX AVAILABLE
CVE-2024-42009 6 exploits
CVSS 9.3 CRITICAL 2024-06-18FIX AVAILABLE
Exploit for Cross-site Scripting in Roundcube WebmailExploit for Cross-site Scripting in Roundcube Webmail
CVE-2017-8114
CVSS 8.8 HIGH 2017-04-29FIX AVAILABLE
CVE-2026-35545
CVSS 8.5 HIGH 2026-03-18FIX AVAILABLE
CVE-2026-48842
CVSS 8.1 HIGH 2026-05-24FIX AVAILABLE
CVE-2026-35537
CVSS 7.8 HIGH 2026-03-18FIX AVAILABLE
CVE-2017-16651 4 exploits
CVSS 7.8 HIGH 2017-09-11FIX AVAILABLE
Roundcube TimeZone Authenticated File DisclosureRoundcube TimeZone Authenticated File Disclosure
CVE-2026-48844
CVSS 7.5 HIGH 2026-05-24FIX AVAILABLE
CVE-2025-68460
CVSS 7.5 HIGH 2025-12-13FIX AVAILABLE
CVE-2018-1000072
CVSS 7.5 HIGH 2018-03-13FIX AVAILABLE
CVE-2026-48848
CVSS 7.2 HIGH 2026-05-24FIX AVAILABLE
CVE-2026-48843
CVSS 7.2 HIGH 2026-05-24FIX AVAILABLE
CVE-2025-68461 1 exploit
CVSS 7.2 HIGH 2025-12-13FIX AVAILABLE
Exploit for CVE-2025-68461
CVE-2020-12626
CVSS 7.1 HIGH 2020-04-30FIX AVAILABLE
CVE-2026-48846
CVSS 6.5 MEDIUM 2026-05-24FIX AVAILABLE
CVE-2026-48845
CVSS 6.5 MEDIUM 2026-05-24FIX AVAILABLE
CVE-2026-35540
CVSS 6.5 MEDIUM 2026-03-18FIX AVAILABLE
CVE-2026-35539
CVSS 6.4 MEDIUM 2026-03-18FIX AVAILABLE
CVE-2024-37383 5 exploits
CVSS 6.4 MEDIUM 2019-11-09FIX AVAILABLE
Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)📄 Roundcube 1.6.6 Cross Site Scripting
CVE-2020-13965 1 exploit
CVSS 6.3 MEDIUM 2019-11-09FIX AVAILABLE
Exploit for Cross-site Scripting in Roundcube Webmail
CVE-2024-57004
CVSS 6.1 MEDIUM 2025-02-03
CVE-2024-37384
CVSS 6.1 MEDIUM 2024-05-19FIX AVAILABLE
CVE-2020-35730 1 exploit
CVSS 6.1 MEDIUM 2020-11-23FIX AVAILABLE
Exploit for SQL Injection in Roundcube Webmail
CVE-2020-16145
CVSS 6.1 MEDIUM 2019-11-09FIX AVAILABLE
CVE-2020-12625
CVSS 6.1 MEDIUM 2019-10-03FIX AVAILABLE
CVE-2020-13964
CVSS 6.1 MEDIUM 2019-11-09FIX AVAILABLE
CVE-2020-15562
CVSS 6.1 MEDIUM 2019-11-09FIX AVAILABLE
CVE-2016-4552
CVSS 6.1 MEDIUM 2016-12-20FIX AVAILABLE
CVE-2026-35544
CVSS 5.3 MEDIUM 2026-03-18FIX AVAILABLE
CVE-2026-35543
CVSS 5.3 MEDIUM 2026-03-18FIX AVAILABLE
CVE-2026-35542
CVSS 5.3 MEDIUM 2026-03-18FIX AVAILABLE
CVE-2026-26079
CVSS 5.0 MEDIUM 2026-02-11FIX AVAILABLE
CVE-2026-25916 2 exploits
CVSS 5.0 MEDIUM 2026-01-01FIX AVAILABLE
📄 Roundcube Webmail SVG TrackingExploit for CVE-2026-25916
CVE-2026-48849 1 exploit
CVSS 4.4 MEDIUM 2026-05-24FIX AVAILABLE
Exploit for CVE-2026-48849
CVE-2019-10740
CVSS 4.3 MEDIUM 2019-04-07FIX AVAILABLE
CVE-2013-5645 1 exploit
CVSS 4.3 MEDIUM 2013-08-29FIX AVAILABLE
Roundcube Webmail 0.9.2 Cross Site Scripting
CVE-2012-4668 1 exploit
CVSS 4.3 MEDIUM 2012-08-25FIX AVAILABLE
Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting
CVE-2012-3508 1 exploit
CVSS 4.3 MEDIUM 2012-08-25FIX AVAILABLE
Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting
CVE-2011-2937
CVSS 4.3 MEDIUM 2011-09-21FIX AVAILABLE
CVE-2007-6321 1 exploit
CVSS 4.3 MEDIUM 2007-12-12FIX AVAILABLE
Roundcube Webmail 0.1 - CSS Expression Input Validation
CVE-2026-35541
CVSS 4.2 MEDIUM 2026-03-17FIX AVAILABLE
CVE-2026-48847
CVSS 3.7 LOW 2026-05-24FIX AVAILABLE
CVE-2013-5646
CVSS 3.5 LOW 2013-08-29FIX AVAILABLE
CVE-2026-35538
CVSS 3.1 LOW 2026-03-18FIX AVAILABLE
CVE-2012-3507
CVSS 2.6 LOW 2012-08-25FIX AVAILABLE