Description

Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.

Remediation

References

CVE-2011-2937

Related Vulnerabilities

WordPress 3.9.x Multiple Vulnerabilities (3.9 - 3.9.16)

MySQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2020-14641)

WordPress Plugin Sports Rankings and Lists Cross-Site Scripting (3.5)

WordPress Plugin Showbiz Pro Responsive Teaser Arbitrary File Upload (1.7.1)

WordPress 4.8.x Multiple Vulnerabilities (4.8 - 4.8.17)

Severity

Medium

Classification

CVE-2011-2937 CWE-707

Tags

Missing Update Known Vulnerabilities