CVE-2012-1253
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer...
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
- Record
CVE-2012-1253- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
- Record
CVE-2012-1253- Updated
- 2026-11-02
EUVDEUVD-2012-1279 No score
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
- Record
EUVD-2012-1279- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3mvr-3jc2-mgf4 No score
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer...
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
- Record
GHSA-3mvr-3jc2-mgf4- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
- Record
CVE-2012-1253- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-1253 No score
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.
- Record
DEBIAN-CVE-2012-1253- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-1253 is a low vulnerability (CVSS 2.6) in Roundcube Webmail, published June 4, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.79%, the 78th percentile. Fixed in roundcube 0.7-1.