Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list
34added in the last 30 days
344new WordPress flaws this week
390,080entries in the database

11 results

  • Feb 20, 2026RoundCube Webmail Deserialization of Untrusted Data VulnerabilityCVE-2025-49113 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.9

    RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.

    Product
    Webmail
    On CISA’s list since
    Feb 20, 2026 (federal fix deadline Mar 13, 2026)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogfearsoff.orggithub.com

  • Feb 20, 2026RoundCube Webmail Cross-site Scripting VulnerabilityCVE-2025-68461 · Websites & servers · Roundcube · reported by MITREExploitedHigh 7.2

    RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.

    Product
    Webmail
    On CISA’s list since
    Feb 20, 2026 (federal fix deadline Mar 13, 2026)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA cataloggithub.comroundcube.net

  • Jun 9, 2025RoundCube Webmail Cross-Site Scripting VulnerabilityCVE-2024-42009 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.3

    RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

    Product
    Webmail
    On CISA’s list since
    Jun 9, 2025 (federal fix deadline Jun 30, 2025)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

  • Oct 24, 2024RoundCube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2024-37383 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1

    RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.

    Product
    Webmail
    On CISA’s list since
    Oct 24, 2024 (federal fix deadline Nov 14, 2024)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

  • Jun 26, 2024Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2020-13965 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1

    Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.

    Product
    Webmail
    On CISA’s list since
    Jun 26, 2024 (federal fix deadline Jul 17, 2024)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

  • Feb 12, 2024Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityCVE-2023-43770 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1

    Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.

    Product
    Webmail
    On CISA’s list since
    Feb 12, 2024 (federal fix deadline Mar 4, 2024)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA cataloggithub.comlists.debian.org

  • Oct 26, 2023Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityCVE-2023-5631 · Websites & servers · Roundcube · reported by security@eset.comExploitedMedium 6.1

    Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.

    Product
    Webmail
    On CISA’s list since
    Oct 26, 2023 (federal fix deadline Nov 16, 2023)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogopenwall.comopenwall.com

  • Jun 22, 2023Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2020-35730 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1

    Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.

    Product
    Roundcube Webmail
    On CISA’s list since
    Jun 22, 2023 (federal fix deadline Jul 13, 2023)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogbugs.debian.orggithub.com

  • Jun 22, 2023Roundcube Webmail Remote Code Execution VulnerabilityCVE-2020-12641 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.8

    Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

    Product
    Roundcube Webmail
    On CISA’s list since
    Jun 22, 2023 (federal fix deadline Jul 13, 2023)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA cataloglists.opensuse.orggithub.com

  • Jun 22, 2023Roundcube Webmail SQL Injection VulnerabilityCVE-2021-44026 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.8

    Roundcube Webmail is vulnerable to SQL injection via search or search_params.

    Product
    Roundcube Webmail
    On CISA’s list since
    Jun 22, 2023 (federal fix deadline Jul 13, 2023)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogbugs.debian.orggithub.com

  • Nov 3, 2021Roundcube Webmail File Disclosure VulnerabilityCVE-2017-16651 · Websites & servers · Roundcube · reported by MITREExploitedHigh 7.8

    Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.

    Product
    Roundcube Webmail
    On CISA’s list since
    Nov 3, 2021 (federal fix deadline May 3, 2022)
    What to do
    Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comsecurityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.