| Package | Affected versions | Patched versions |
|---|---|---|
| webmail | ≥ 1.3.0, < 1.3.14≥ 1.4.0, < 1.4.7< 1.2.11 | 1.3.141.4.71.2.11 |
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free