Summary
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
- Vendor
- Roundcube
- Product
- Webmail
- Added to KEV
- Jun 9, 2025
- Remediation due
- Jun 30, 2025 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-79
- EPSS
- 82.9% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References