CVE-2012-3507: Roundcube Webmail

Low severity, CVSS 2.6. EPSS: 2.1% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject.

Affected products

• Roundcube Webmail: up to and including 0.7.3; version 0.1 only; version 0.1.1 only; version 0.2 only; version 0.2.1 only; version 0.2.2 only; …

Published 2012-08-25. Last modified 2026-06-16.