CVE-2020-12625

An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.

• CWE-79

• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.htmlThird Party Advisory
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-RoundcubeExploit, Third Party Advisory
• https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0Patch, Third Party Advisory
• https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4Patch, Third Party Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.4.4Third Party Advisory
• https://security.gentoo.org/glsa/202007-41Third Party Advisory
• https://www.debian.org/security/2020/dsa-4674Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.htmlThird Party Advisory
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-12625-Cross%20Site-Scripting%20via%20Malicious%20HTML%20Attachment-RoundcubeExploit, Third Party Advisory
• https://github.com/roundcube/roundcubemail/commit/87e4cd0cf2c550e77586860b94e5c75d2b7686d0Patch, Third Party Advisory
• https://github.com/roundcube/roundcubemail/compare/1.4.3...1.4.4Patch, Third Party Advisory
• https://github.com/roundcube/roundcubemail/releases/tag/1.4.4Third Party Advisory
• https://security.gentoo.org/glsa/202007-41Third Party Advisory
• https://www.debian.org/security/2020/dsa-4674Third Party Advisory

Published

May 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12618eM Client before 7.2.33412.0 automatically imported S/MIME c…4.8
• CVE-2020-12619MailMate before 1.11 automatically imported S/MIME certifica…5.9
• CVE-2020-1262An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-12620Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-s…7.8
• CVE-2020-12621The Teamwire application 5.3.0 for Android allows physically…6.1
• CVE-2020-12624The League application before 2020-05-02 on Android sends a …6.5
• CVE-2020-12626An issue was discovered in Roundcube Webmail before 1.4.4. A…6.5
• CVE-2020-12627Calibre-Web 0.6.6 allows authentication bypass because of th…9.8
• CVE-2020-12629include/class.sla.php in osTicket before 1.14.2 allows XSS v…5.4
• CVE-2020-1263An information disclosure vulnerability exists in the way Wi…5.5
• CVE-2020-12635XSS exists in the WebForms Pro M2 extension before 2.9.17 fo…6.1
• CVE-2020-12637Zulip Desktop before 5.2.0 has Missing SSL Certificate Valid…9.8