CVE-2024-42008

This repository contains a functional proof-of-concept for exploiting CVE-2024-42008 (XSS via malicious XML attachment) and CVE-2024-42010 (HTML exfiltration via CSS injection) in Roundcube Webmail. The exploit chain involves sending a malicious email with an XML attachment and CSS import to exfiltrate the UID of the attachment, enabling XSS execution.

This repository contains a functional exploit for CVE-2024-42008, a Cross-Site Scripting (XSS) vulnerability in RoundCube webmail. The exploit leverages CSS animation properties to bypass content filters and execute arbitrary JavaScript in the context of the webmail application.

This repository contains a functional exploit for CVE-2024-42008 and CVE-2024-42009, targeting Roundcube 1.6.7. The exploit leverages XSS to exfiltrate email contents via a crafted payload delivered through a contact form.