Actively exploited vulnerabilities affecting Roundcube products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-49113https://wildfortech.com/security#CVE-2025-49113RoundCube Webmail contains a flaw where the '_from' parameter in a URL is not validated during file uploads, allowing any authenticated user to trigger deserialization of untrusted data and achieve remote code execution on the server. This means an attacker with only a standard webmail login can potentially take full control of the underlying system — no admin privileges required. Organizations running RoundCube as their webmail platform are directly at risk of server compromise.Fri, 20 Feb 2026 00:00:00 GMTRoundcubeWebmailhttps://wildfortech.com/security#CVE-2025-68461https://wildfortech.com/security#CVE-2025-68461This flaw allows attackers to inject malicious scripts into RoundCube Webmail by embedding JavaScript inside an SVG document's animate tag. Because webmail runs in the browser and handles untrusted email content, a successful exploit could let an attacker hijack a user's session, steal credentials, or perform actions on their behalf — all without any interaction beyond opening a crafted email. RoundCube is widely deployed in enterprise and hosting environments, making this a high-value target.Fri, 20 Feb 2026 00:00:00 GMTRoundcubeWebmailhttps://wildfortech.com/security#CVE-2024-42009https://wildfortech.com/security#CVE-2024-42009This cross-site scripting flaw in Roundcube Webmail allows an attacker to craft a malicious email that, when viewed by a victim, exploits a desanitization bug in the mail display code. The practical result is serious: an attacker can silently steal the victim's emails or send emails on their behalf without any interaction beyond opening the message. Because Roundcube is widely used in enterprise and government environments, this flaw poses a significant risk of credential theft and data exfiltration.Mon, 09 Jun 2025 00:00:00 GMTRoundcubeWebmail