CVE-2024-37383

This exploit demonstrates a stored XSS vulnerability in Roundcube Webmail versions earlier than 1.5.6 or from 1.6 to 1.6.6. It automates the retrieval of all inbox messages and forwards them to an attacker-controlled server via JavaScript injection.

This repository contains a functional proof-of-concept exploit for CVE-2024-37383, an XSS vulnerability in Roundcube. The exploit sends a crafted email with an SVG-based payload that triggers an alert when clicked by the victim in Roundcube's web interface.

This repository contains a functional PoC for CVE-2024-37383, an XSS vulnerability in Roundcube Webmail due to improper SVG attribute parsing. It includes a Docker setup for a vulnerable environment and a Python script to send a malicious email with an SVG payload.

This repository contains a functional JavaScript-based exploit for CVE-2024-37383, a stored XSS vulnerability in Roundcube Webmail. The exploit automates the extraction of all messages from a victim's inbox and forwards them to an attacker-controlled server via crafted SVG payloads.