CVE-2025-68461

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Feb 20, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-684623.2Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.CVE-2025-684634.9Bio.Entrez in Biopython through 186 allows doctype XXE.CVE-2025-684673.4Dark Reader is an accessibility browser extension that makes web pages colors dark. The dynamic dark mode feature of the extension works by CVE-2025-684686.5Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-dCVE-2025-684693.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.1-14, ImageMagick crasheCVE-2025-68479.8A vulnerability classified as critical was found in code-projects Simple Forum 1.0. This vulnerability affects unknown code of the file /forCVE-2025-684706.5React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so thCVE-2025-684716.5Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-dCVE-2025-684729.1MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversalCVE-2025-684738.6ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the CVE-2025-684747.6ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the CVE-2025-684757.5Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.