CVE-2020-12641 CISA KEV · Actively exploited
roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path
CVSS score
8.1
EPSS probability
%84.5
Risk score
13.7
Published
6 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
CVE-2020-12641: Command Injection via “_im_convert_path” Parameter in Roundcube Webmail
Makefile Go / Python
Nuclei: Roundcube Webmail - Command Injection
Makefile Go / Python
Similar Vulnerabilities
9.9
CVE-2025-49113 Actively exploited
roundcubemail: Remote Code Execution in Roundcube via Unvalidated _from Parameter
R
Workaround Public Exploits:12EPSS %99
9.3
CVE-2024-42009 Actively exploited
roundcubemail: A Cross-Site Scripting vulnerability in Roundcube
R
Workaround Public Exploits:7EPSS %83
9.8
CVE-2021-44026 Actively exploited
roundcubemail: potential SQL injection via search or search_params.
R
Workaround Public Exploits:2EPSS %70
6.1
CVE-2020-13965 Actively exploited
roundcubemail: XSS via a malicious XML attachment
R
Workaround Public Exploits:1EPSS %77
5.4
CVE-2023-5631 Actively exploited
roundcube: cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages
R
WorkaroundEPSS %76
7.2
CVE-2020-35730 Actively exploited
roundcubemail: XSS via HTML or plain text messages with malicious content
R
WorkaroundEPSS %33
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2020-12641"