# Roundcube Webmail


- [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild)
- [CVE-2021-44026](https://insights.sbomify.com/CVE-2021-44026/): Roundcube Webmail SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2020-12641](https://insights.sbomify.com/CVE-2020-12641/): Roundcube Webmail Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2024-42009](https://insights.sbomify.com/CVE-2024-42009/): RoundCube Webmail Cross-Site Scripting (critical 9.3, exploited in the wild)
- [CVE-2017-16651](https://insights.sbomify.com/CVE-2017-16651/): Roundcube Webmail File Disclosure (high 7.8, exploited in the wild)
- [CVE-2025-68461](https://insights.sbomify.com/CVE-2025-68461/): RoundCube Webmail Cross-site Scripting (high 7.2, exploited in the wild)
- [CVE-2020-13965](https://insights.sbomify.com/CVE-2020-13965/): Roundcube Webmail Cross-Site Scripting (XSS) (medium 6.3, exploited in the wild)
- [CVE-2024-37383](https://insights.sbomify.com/CVE-2024-37383/): RoundCube Webmail Cross-Site Scripting (XSS) (medium 6.1, exploited in the wild)
- [CVE-2023-5631](https://insights.sbomify.com/CVE-2023-5631/): Roundcube Webmail Persistent Cross-Site Scripting (XSS) (medium 6.1, exploited in the wild)
- [CVE-2023-43770](https://insights.sbomify.com/CVE-2023-43770/): Roundcube Webmail Persistent Cross-Site Scripting (XSS) (medium 6.1, exploited in the wild)
- [CVE-2020-35730](https://insights.sbomify.com/CVE-2020-35730/): Roundcube Webmail Cross-Site Scripting (XSS) (medium 6.1, exploited in the wild)
- [CVE-2008-5619](https://insights.sbomify.com/CVE-2008-5619/): PHPMailer susceptible to arbitrary code execution (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/products/roundcube/webmail/