Description

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

Remediation

References

CVE-2026-35538

Related Vulnerabilities

Moodle Resource Management Errors Vulnerability (CVE-2015-2268)

Joomla Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-8563)

WordPress Plugin UserPro-Community and User Profile Cross-Site Scripting (2.33)

Chamilo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2025-50191)

Piwigo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-2209)

Severity

Low

Classification

CVE-2026-35538 CWE-707 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities