Description
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
Remediation
References
Related Vulnerabilities
WordPress Improper Privilege Management Vulnerability (CVE-2020-28035)
GeoServer Improper Restriction of XML External Entity Reference Vulnerability (CVE-2025-58360)
WordPress Plugin Form Builder CP Unspecified Vulnerability (1.2.15)
Apache HTTP Server Other Vulnerability (CVE-1999-1199)
OpenSSL Access of Resource Using Incompatible Type ('Type Confusion') Vulnerability (CVE-2024-6119)