roundcube webmail vulnerabilities in 2021, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 9.8CVE-2021-44026KEVEPSS 70%2021-11-19

   Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

2. 6.1CVE-2021-44025EPSS 1.2%2021-11-19

   Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.

3. 5.4CVE-2020-18671EPSS 0.8%2021-06-24

   Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.

4. 5.4CVE-2020-18670EPSS 0.9%2021-06-24

   Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.

5. 5.4CVE-2021-26925EPSS 1.0%2021-02-09

   Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.