July 26, 2026

CVE Watchtower


← Back to CVE List

CVE-2025-68461NVD

Vulnerability Summary

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
Severity Level
HIGH(7.2)
Published Date
Dec 18, 2025
Last Modified
Feb 23, 2026
Exploitation Status
ACTIVE
EPSS Score (30-Day)
6.44%Probability
Root Weakness (CWE)
CWE-79: Cross-site Scripting (XSS) ↗
The software does not neutralize user-controllable input before it is placed in output that is used as a web page.
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeChanged
ConfidentialityLow
IntegrityLow
AvailabilityNone

External References