Total vulnerabilities in the database
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker
to load arbitrary JavaScript code.
| Software | From | Fixed in |
|---|---|---|
| roundcube / webmail | 1.6.0 | 1.6.4 |
| roundcube / webmail | 1.5.0 | 1.5.5 |
| roundcube / webmail | - | 1.4.15 |
| debian / debian_linux | 11.0 | 11.0.x |
| debian / debian_linux | 12.0 | 12.0.x |
| debian / debian_linux | 10.0 | 10.0.x |
| fedoraproject / fedora | 39 | 39.x |