UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114718

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the…

Severity
Medium 6.1
Published
22 Oct 2026
Last changed
30 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.6.20, 1.7.5
Sources
NVD

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cpe:a:roundcube:webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-114718
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114718