Description

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

Remediation

References

CVE-2023-5631

Related Vulnerabilities

XWiki Exposure of Resource to Wrong Sphere Vulnerability (CVE-2023-35151)

WordPress Plugin MetaSlider Cross-Site Scripting (3.17.1)

MySQL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-4414)

WordPress Plugin U BuddyPress Forum Attachment 'fileurl' Parameter Remote File Disclosure (1.1.1)

WordPress 4.1.x Multiple Vulnerabilities (4.1 - 4.1.12)

Severity

Medium

Classification

CVE-2023-5631 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities