CVE-2020-13965
KEVMEDIUM 6.3EPSS 76.6%
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
- CVSS v3.1
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v3.1
- 6.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS v2.0
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 76.60% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2024-06-26
- Published
- 2020-06-09
- Updated
- 2025-10-21
Proof-of-concept exploits (3)
- DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malic…
- mbadanoiu/CVE-2020-139650★ · 2024-04-13
- victoni/Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC2★ · 2025-04-12