GCVE-110-NCSC-2025-405

Advisory PublishedCVSS 7.2/10

Vulnetix · Advisory published December 31, 2025

Roundcube Webmail versions prior to 1.5.12 and 1.6 before 1.6.12 have a Moderate-rated XSS vulnerability in SVG handling due to improper sanitization of the <animate> tag.

Download JSON Open in Console

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Risk Scores

CVSS 3.1

7.2/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
roundcube	vers:unknown/*	—	—
RoundCube	vers:unknown/*	—	—
Open Source	vers:unknown/*	—	—

Aliases

CVE-2025-68461

References

advisory

Browse GCVE Records

73,873 records in the GCVE database · Updated July 20, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON