目标达成 感谢每一位支持者 — 我们达成了 100% 目标!

目标: 1000 元 · 已筹: 1000

100.0%
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2025-49113 基础信息
漏洞信息

对漏洞内容有疑问?看看神龙的深度分析是否有帮助!
查看神龙十问 ↗

尽管我们使用了先进的大模型技术,但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性,但请您根据实际情况进行核实和判断。

Vulnerability Title
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
来源: 美国国家漏洞数据库 NVD
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
可信数据的反序列化
来源: 美国国家漏洞数据库 NVD
Vulnerability Title
Roundcube Webmail 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Roundcube Webmail是Roundcube开源的一款基于浏览器的开源IMAP客户端,它支持地址薄管理、信息搜索、拼写检查等。 Roundcube Webmail 1.5.10之前版本和 1.6.11之前版本存在安全漏洞,该漏洞源于未验证_from参数,可能导致PHP对象反序列化攻击。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
厂商产品影响版本CPE订阅
RoundcubeWebmail 0 ~ 1.5.10 -
二、漏洞 CVE-2025-49113 的公开POC
#POC 描述源链接神龙链接
1Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49113.yamlPOC详情
2Detection for CVE-2025-49113https://github.com/rxerium/CVE-2025-49113POC详情
3CVE-2025-49113 - Roundcube <= 1.6.10 Post-Auth RCE via PHP Object Deserializationhttps://github.com/Ademking/CVE-2025-49113-nuclei-templatePOC详情
4Nonehttps://github.com/fearsoff-org/CVE-2025-49113POC详情
5Nonehttps://github.com/rasool13x/exploit-CVE-2025-49113POC详情
6CVE-2025-49113 exploithttps://github.com/SyFi/CVE-2025-49113POC详情
7Proof of Concept demonstrating Remote Code Execution through insecure deserialization in Roundcube (CVE-2025-49113).https://github.com/hakaioffsec/CVE-2025-49113-exploitPOC详情
8Proof-of-concept to CVE-2025-49113https://github.com/BiiTts/Roundcube-CVE-2025-49113POC详情
9Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.https://github.com/Yuri08loveElaina/CVE-2025-49113POC详情
10CVE-2025-49113https://github.com/B1ack4sh/Blackash-CVE-2025-49113POC详情
11Explicação + Lab no THMhttps://github.com/5kr1pt/Roundcube_CVE-2025-49113POC详情
12Nonehttps://github.com/punitdarji/roundcube-cve-2025-49113POC详情
13A powerful Python scanner to detect CVE-2025-49113 vulnerability in Roundcube Webmail. Developed by Issam Junior (@issamiso).https://github.com/issamjr/CVE-2025-49113-ScannerPOC详情
14Nonehttps://github.com/hackmelocal/HML-CVE-2025-49113-Round-CubePOC详情
15Nonehttps://github.com/Joelp03/CVE-2025-49113POC详情
16Nonehttps://github.com/hackmelocal/CVE-2025-49113-SimulationPOC详情
17💥 Python Exploit for CVE-2025-49113 | Roundcube Webmail RCE via PHP Object Injectionhttps://github.com/00xCanelo/CVE-2025-49113POC详情
18Nonehttps://github.com/CyberQuestor-infosec/CVE-2025-49113-Roundcube_1.6.10POC详情
19This is a rewritten exploit to work with phphttps://github.com/SteamPunk424/CVE-2025-49113-Roundcube-RCE-PHPPOC详情
20POC of CVE-2025-49113https://github.com/Zwique/CVE-2025-49113POC详情
21Python Script for CVE-2025-49113. Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.https://github.com/AC8999/CVE-2025-49113POC详情
22Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserializationhttps://github.com/LeakForge/CVE-2025-49113POC详情
23Nonehttps://github.com/Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-POC详情
24CVE-2025-49113 - Roundcube Remote Code Executionhttps://github.com/l4f2s4/CVE-2025-49113_exploit_cookiesPOC详情
25Hands-on exploitation lab for Roundcube Webmail CVE-2025-49113 (authenticated PHP object deserialization → RCE) to read /secret.txt.https://github.com/ankitpandey383/roundcube-cve-2025-49113-labPOC详情
26CVE-2025-49113https://github.com/Ashwesker/Blackash-CVE-2025-49113POC详情
27CVE-2025-49113https://github.com/Ashwesker/Ashwesker-CVE-2025-49113POC详情
28Nonehttps://github.com/Evillm/CVE-2025-49113-PoCPOC详情
AI 生成 POC高级

未找到公开 POC。

登录以生成 AI POC
三、漏洞 CVE-2025-49113 的情报信息
Please 登录 to view more intelligence information
IV. Related Vulnerabilities
V. Comments for CVE-2025-49113
匿名用户
2026-01-15 06:09:53

Zaproxy alias impedit expedita quisquam pariatur exercitationem. Nemo rerum eveniet dolores rem quia dignissimos.


发表评论