CVE-2020-35730

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 28, 2020
Last modified
Jun 17, 2026
Added to CISA KEV
Jun 22, 2023
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-357337.5An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a truCVE-2020-357347.2Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fieldCVE-2020-357354.7Vidyo 02-09-/D allows clickjacking via the portal/ URI.CVE-2020-357367.5GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.CVE-2020-357377.5In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating theCVE-2020-357386.1WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: soCVE-2020-35747.5A vulnerability in the TCP packet processing functionality of Cisco IP Phones could allow an unauthenticated, remote attacker to cause the pCVE-2020-357406.1HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.CVE-2020-357416.1HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntaCVE-2020-357427.6HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter.CVE-2020-357437.6HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages.CVE-2020-357458.8PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all d