An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
CVE-2020-13965
Score elevated to 9.0 because this CVE is listed on the CISA Known Exploited Vulnerabilities catalog (added 2024-06-26), indicating real-world exploitation has been confirmed by US federal agencies. NVD baseline CVSS 6.1 retained for reference. Confidence: HIGH.
- Actively exploited in the wild (CISA-KEV)
A fix is available — apply it.
- CVSS v3
- 6.1
- EG Score
- 9.0(high)
- EG Risk
- 81(Attend)EG Risk 81/100SSVC: Attend
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity90% × 45%Exploitation100% × 40%Automatability0% × 15%Action: Remediate soon — notable exploitation risk. - EPSS PROB
- 77%
- EPSS %ILE
- 99%
- KEV
- ⚠ Exploited
Published
June 9, 2020
Last Modified
November 4, 2025
Advisory Details (9)
Auto-updated Jun 13, 2026Disclosures/CVE-2020-13965-Cross Site-Scripting via Malicious XML Attachment-Roundcube at master · DrunkenShells/Disclosures · GitHub
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube[SECURITY] [DSA 4700-1] roundcube security update
https://www.debian.org/security/2020/dsa-4700Security updates 1.4.5 and 1.3.12 released
https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12[SECURITY] Fedora 32 Update: roundcubemail-1.4.6-1.fc32 - package-announce - Fedora mailing-lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/[SECURITY] Fedora 31 Update: roundcubemail-1.4.6-1.fc31 - package-announce - Fedora mailing-lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/Roundcube Webmail 1.4.5
Patch available: roundcube/roundcubemail 1.4.5
https://github.com/roundcube/roundcubemail/releases/tag/1.4.5Roundcube Webmail 1.3.12
Patch available: roundcube/roundcubemail 1.3.12
https://github.com/roundcube/roundcubemail/releases/tag/1.3.12Comparing 1.4.4...1.4.5 · roundcube/roundcubemail · GitHub
https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5commit 884eb611627e (roundcube/roundcubemail)
Fix landed in roundcube/roundcubemail commit 884eb611627e — awaiting tagged release
https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3Patch Availability(1)
| Vendor / Ecosystem | Fixed in / Patch | Released | Source |
|---|---|---|---|
| ubuntu | roundcube-sqlite3 (1.2~beta+dfsg.1-0ubuntu1+esm2) @ xenial | 2026-07-27 | ubuntu |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
Weakness Classification(2)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
All Vendor Advisories
(1)
Every vendor that published an advisory referencing this CVE — pulled from our cve_vendor_advisories aggregation. Click any row for the vendor's original advisory page.
Data Freshness Timeline
(refreshed 43× in last 7d / 288× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
Showing the most recent 100 of 601 total refreshes for this CVE.
- 2026-07-27 09:14 UTCVendor advisory
- 2026-07-27 09:14 UTCGHSA enrichment
- 2026-07-27 04:50 UTCGHSA enrichment
- 2026-07-27 00:26 UTCGHSA enrichment
- 2026-07-26 19:59 UTCGHSA enrichment
- 2026-07-26 15:35 UTCEG score recompute
- 2026-07-26 15:35 UTCVendor advisory
- 2026-07-26 15:35 UTCGHSA enrichment
- 2026-07-26 14:51 UTCEPSS rescore
- 2026-07-26 11:09 UTCEG score recompute
- 2026-07-26 11:09 UTCGHSA enrichment
- 2026-07-26 06:43 UTCVendor advisory
- 2026-07-26 06:43 UTCGHSA enrichment
- 2026-07-26 02:17 UTCEG score recompute
- 2026-07-26 02:17 UTCVendor advisory
- 2026-07-26 02:17 UTCGHSA enrichment
- 2026-07-24 14:14 UTCEPSS rescore
- 2026-07-23 01:49 UTCEG score recompute
- 2026-07-22 22:24 UTCEG score recompute
- 2026-07-22 22:24 UTCVendor advisory
- 2026-07-22 22:23 UTCGHSA enrichment
- 2026-07-22 19:40 UTCCISA KEV update
- 2026-07-22 17:58 UTCEG score recompute
- 2026-07-22 17:58 UTCGHSA enrichment
- 2026-07-22 14:05 UTCEPSS rescore
Show 75 moreShow fewer
- 2026-07-22 13:31 UTCGHSA enrichment
- 2026-07-22 09:07 UTCGHSA enrichment
- 2026-07-22 04:43 UTCGHSA enrichment
- 2026-07-22 00:17 UTCGHSA enrichment
- 2026-07-21 18:33 UTCGHSA enrichment
- 2026-07-21 14:37 UTCCISA KEV update
- 2026-07-21 14:08 UTCGHSA enrichment
- 2026-07-21 09:44 UTCGHSA enrichment
- 2026-07-21 05:19 UTCGHSA enrichment
- 2026-07-21 00:53 UTCVendor advisory
- 2026-07-21 00:53 UTCGHSA enrichment
- 2026-07-20 20:29 UTCEG score recompute
- 2026-07-20 20:29 UTCVendor advisory
- 2026-07-20 20:29 UTCGHSA enrichment
- 2026-07-20 17:04 UTCEPSS rescore
- 2026-07-20 16:05 UTCGHSA enrichment
- 2026-07-20 11:39 UTCVendor advisory
- 2026-07-20 11:39 UTCGHSA enrichment
- 2026-07-20 07:15 UTCVendor advisory
- 2026-07-20 07:15 UTCGHSA enrichment
- 2026-07-20 02:52 UTCVendor advisory
- 2026-07-20 02:52 UTCGHSA enrichment
- 2026-07-19 22:27 UTCVendor advisory
- 2026-07-19 22:27 UTCGHSA enrichment
- 2026-07-19 18:04 UTCEG score recompute
- 2026-07-19 18:04 UTCVendor advisory
- 2026-07-19 18:04 UTCGHSA enrichment
- 2026-07-19 14:28 UTCEPSS rescore
- 2026-07-19 14:28 UTCEPSS rescore
- 2026-07-19 13:39 UTCVendor advisory
- 2026-07-19 13:39 UTCGHSA enrichment
- 2026-07-19 09:15 UTCVendor advisory
- 2026-07-19 09:15 UTCGHSA enrichment
- 2026-07-19 04:50 UTCVendor advisory
- 2026-07-19 04:50 UTCGHSA enrichment
- 2026-07-19 00:26 UTCVendor advisory
- 2026-07-19 00:26 UTCGHSA enrichment
- 2026-07-18 20:02 UTCVendor advisory
- 2026-07-18 20:02 UTCGHSA enrichment
- 2026-07-18 15:37 UTCVendor advisory
- 2026-07-18 15:37 UTCGHSA enrichment
- 2026-07-18 11:13 UTCVendor advisory
- 2026-07-18 11:13 UTCGHSA enrichment
- 2026-07-18 06:49 UTCVendor advisory
- 2026-07-18 06:49 UTCGHSA enrichment
- 2026-07-18 02:25 UTCVendor advisory
- 2026-07-18 02:25 UTCGHSA enrichment
- 2026-07-17 22:01 UTCVendor advisory
- 2026-07-17 22:01 UTCGHSA enrichment
- 2026-07-17 17:37 UTCGHSA enrichment
- 2026-07-17 13:13 UTCGHSA enrichment
- 2026-07-17 08:48 UTCEG score recompute
- 2026-07-17 08:48 UTCGHSA enrichment
- 2026-07-17 04:24 UTCGHSA enrichment
- 2026-07-17 00:00 UTCVendor advisory
- 2026-07-17 00:00 UTCGHSA enrichment
- 2026-07-16 19:36 UTCVendor advisory
- 2026-07-16 19:36 UTCGHSA enrichment
- 2026-07-16 17:04 UTCCISA KEV update
- 2026-07-16 15:11 UTCGHSA enrichment
- 2026-07-16 10:47 UTCVendor advisory
- 2026-07-16 10:46 UTCGHSA enrichment
- 2026-07-16 06:22 UTCGHSA enrichment
- 2026-07-16 01:58 UTCVendor advisory
- 2026-07-16 01:58 UTCGHSA enrichment
- 2026-07-15 21:34 UTCVendor advisory
- 2026-07-15 21:34 UTCGHSA enrichment
- 2026-07-15 17:10 UTCGHSA enrichment
- 2026-07-15 16:55 UTCEPSS rescore
- 2026-07-15 16:49 UTCCISA KEV update
- 2026-07-15 15:04 UTCCISA KEV update
- 2026-07-15 12:46 UTCGHSA enrichment
- 2026-07-15 08:21 UTCGHSA enrichment
- 2026-07-15 03:57 UTCVendor advisory
- 2026-07-15 03:57 UTCGHSA enrichment
Related CVEs(same vendor + same CWE)
Same vendor
10 shownubuntu
- CVE-2004-0989EG 10.0EPSS p97HIGH
- CVE-2004-0990EG 10.0EPSS p98HIGH
- CVE-2004-1010EG 10.0EPSS p95HIGH
- CVE-2004-0941EG 10.0EPSS p95HIGH
- CVE-2004-0981EG 10.0EPSS p92HIGH
- CVE-2004-0882EG 10.0EPSS p96HIGH
- CVE-2004-0888EG 10.0EPSS p95HIGH
- CVE-2004-1012EG 10.0EPSS p93HIGH
- CVE-2004-1013EG 10.0EPSS p92HIGH
- CVE-2004-1018EG 10.0EPSS p97HIGH
Same CWE
10 shownCWE-79 · CWE-80
Frequently asked(6)
What is CVE-2020-13965?
When was CVE-2020-13965 disclosed?
Is CVE-2020-13965 actively exploited?
What is the CVSS score of CVE-2020-13965?
Which products are affected by CVE-2020-13965?
How do I remediate CVE-2020-13965?
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2020-13965
Is Your Infrastructure Affected by CVE-2020-13965?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.