Roundcube Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Vulnerability (CVE-2026-35538)

Description

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

Remediation

References

CVE-2026-35538

Related Vulnerabilities

WordPress Plugin Esponce QR Code Generator Cross-Site Scripting (1.4)

TCExam Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5750)

Apache Traffic Server Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2026-58157)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-3766)

WordPress Plugin Advanced Booking Calendar SQL Injection (1.6.1)

Severity

Low

Classification

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N