MEIFP – Most Exploited Internet-Facing Products

Roundcube

Products: Roundcubemail · Webmail

67.0

Score

CVEs

Active

PoC

KEV

#36

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2025-68461	2025-12-18	7.2v3.1	ACTIVE		Low	None	YES	40.6	Webmail	Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVE-2025-49113	2025-06-02	9.9v3.1	ACTIVE		Low	Low	no	26.4	Webmail	Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3