CVE-2026-74999

Katalog CVE

CVSS 5.4 · Medium EPSS 0,31%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada roundcube webmail. Skor CVSS 3.1 5.4 (Medium) menurut mitre.org.

Deskripsi (NVD)

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.

Rincian

Terbit di NVD

17 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3 advisory vendor
• https://github.com/roundcube/roundcubemail/commit/2d2a9604a820ee279c9ffcfe856b9b93a93995a8 patch
• https://github.com/roundcube/roundcubemail/commit/32f20c6bfd12dff9cfb6880ae303e740f0804fe8 patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.3 release notes