CVE-2013-5645: Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted r...

Security readout for executives and security teams

Roundcube webmail before 0.9.3 had multiple XSS flaws. A malicious email or crafted HTML signature could cause script or HTML injection when a user interacted with affected compose flows. Business risk is highest where old Roundcube installations remain internet-facing. Exposure is likely limited to organizations still running Roundcube webmail before 0.9.3, including legacy distro packages or unmanaged webmail appliances. Publicly reachable webmail increases practical risk. Address during normal vulnerability remediation, accelerated for internet-facing or business-critical webmail. The issue is old, but legacy Roundcube exposure can still create account and session risk. Mitigation focus: Upgrade Roundcube to 0.9.3 or later.; Apply the relevant distribution security update where Roundcube is packaged.; Review vendor guidance before changing HTML email or signature handling..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.