roundcubemail: Remote Code Execution in Roundcube via Unvalidated _from Parameter
CVSS Skor
9.9
EPSS İhtimal
%99.0
Risk Skoru
19.6
Yayın
1 yıl önce
Public Exploits · GitHub ve Metasploit Intelligence
Bu sekme NVD’nin exploit olarak etiketlediği kaynakları, CVE kimliğiyle eşleşen GitHub depolarını ve Rapid7 Metasploit Framework modüllerini tarar. Yalnızca bulunan gerçek kaynak bağlantıları gösterilir.
CVE-2025-49113 – Roundcube ≤1.6.10 post-auth RCE via PHP object deserialization (HackTheBox CTF)
Roundcube Webmail post-auth RCE via PHP object deserialization (CVE-2025-49113)
Hands-on exploitation lab for Roundcube Webmail CVE-2025-49113 (authenticated PHP object deserialization → RCE) to read /secret.txt.
CVE-2025-49113 - Roundcube Remote Code Execution
Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-
Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization
Python Script for CVE-2025-49113. Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
Roundcube 1.6.10 - Remote Code Execution (RCE)
Nuclei: Roundcube Webmail - Remote Code Execution
İlgili Benzer Açıklar
roundcubemail: A Cross-Site Scripting vulnerability in Roundcube
roundcubemail: potential SQL injection via search or search_params.
roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path
roundcubemail: XSS via a malicious XML attachment
roundcube: cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages
roundcubemail: XSS via HTML or plain text messages with malicious content
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-49113"