Known vulnerabilities in Roundcube Webmail 1.1.4

Vendor: Roundcube
Version: 1.1.4
Software CPE: cpe:2.3:a:roundcube:roundcube:*:*:*:*:*:*:*:*
Total vulnerabilities: 24
Public exploits: 1
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.2

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Roundcube Webmail version 1.1.4 Roundcube Webmail 1.1.4 is affected by 24 vulnerabilities: 1 critical, 1 high, 15 medium, 7 low Critical High Medium Low

Vulnerabilities (24)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU141369 - Improper input validation
CWE-20 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141370 - Improper input validation
CWE-20 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141371 - Improper input validation
CWE-20 Low
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141372 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-90 Low
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141373 - Improper Access Control
CWE-284 Low
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141374 - Command injection
CWE-77 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141375 - Improper input validation
CWE-20 Low
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141376 - Exposure of sensitive information to an unauthorized actor
CWE-200 Low
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141377 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141378 - Improper input validation
CWE-20 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU141368 - Improper input validation
CWE-20 Medium
No
No
1.6.18, 1.7.3 09.08.2026 SB2026080905
#VU124136 - Deserialization of Untrusted Data
CWE-502 Critical
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124137 - Missing Authentication for Critical Function
CWE-306 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124138 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-93 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124139 - Improper Encoding or Escaping of Output
CWE-116 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124140 - Improper Encoding or Escaping of Output
CWE-116 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124141 - Improper Encoding or Escaping of Output
CWE-116 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124142 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU124143 - Server-Side Request Forgery (SSRF)
CWE-918 Medium
No
No
1.5.14, 1.6.14 19.03.2026 SB2026031948
#VU82083 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-5631
CWE-79 High
No
Exploited
1.4.15, 1.5.5, 1.6.4 17.10.2023 SB2023101721
SB2023102405
SB2023102406
and 5 more


Showing elements 1 - 20 out of 24