Back to CVE Browser

CVE-2020-35730

🔥 Known Exploited (CISA KEV)MEDIUM

6.1

CVSS Severity Score

EPSS Score65.4580%

EPSS Percentile97.94th

Published2020-12-28

Last Modified2025-11-04

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

Affected Platforms (CPE)

📦

Roundcube

Webmail

< 1.2.13>= 1.3.0 and < 1.3.16>= 1.4 and < 1.4.10

💻

Fedoraproject

Fedora

= 32= 33

💻

Debian

Debian Linux

= 9.0

References & Advisories

🔗 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491

🔗 https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10

🔗 https://github.com/roundcube/roundcubemail/releases/tag/1.2.13

🔗 https://github.com/roundcube/roundcubemail/releases/tag/1.3.16

🔗 https://github.com/roundcube/roundcubemail/releases/tag/1.4.10

🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/

🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/

🔗 https://roundcube.net/download/

Related Vulnerabilities

CVE-2026-544337.2

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text ema...

CVE-2026-544324.7

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the atta...

CVE-2026-626446.4

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username sp...

CVE-2026-626437.2

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail m...