CVE-2024-42009

CriticalCVSS 9.3/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Jun 9, 2025
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-42014.4A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting fr CVE-2024-420107.5mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in ren CVE-2024-420117.5The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat.CVE-2024-420125.7GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. At the login screen, the user's password is compared to the user'CVE-2024-420136.4In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability. An attacker with Windows adm CVE-2024-4201710.0An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenar CVE-2024-420187.7An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved CVE-2024-420198.0A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user int CVE-2024-42028.6In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiati CVE-2024-420205.4A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.CVE-2024-420216.5An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.CVE-2024-420225.3An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.