CVE-2015-8105: Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to…

PriorityP413low3.5CVSS 2.0

AVNACMAuSCNIPAN

EPSS

1.46%

70.3th percentile

Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	roundcube	< roundcube 1.1.3+dfsg.1-1 (bookworm)	roundcube 1.1.3+dfsg.1-1 (bookworm)
opensuse	opensuse	—	—
opensuse	opensuse	—	—
roundcube	webmail	<= 1.0.6	—
roundcube	webmail	—	—
roundcube	webmail	—	—
roundcube	webmail	—	—

CVSS provenance

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

osv3.5LOW

vendor_debian3.5LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.