Description
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Remediation
References
Related Vulnerabilities
Jboss EAP Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2017-2670)
WordPress Plugin Numbers generator and validator Multiple Unspecified Vulnerabilities (1.02)
WordPress Plugin Transposh WordPress Translation Cross-Site Scripting (0.8.3)
Liferay DXP Insecure Default Initialization of Resource Vulnerability (CVE-2024-25610)