CVE Feed

    Dashboard / CVE / CVE-2008-5619

    CVE-2008-5619

    html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.

    Published:Dec 9, 2008
    Last Modified:Apr 23, 2026
    EPS:Dec 17, 2008
    EPSS Score:0.77692
    CVSS Score:10

    Affected Products

    Vendor
    Roundcube
    Product
    Webmail

    Exploits

    http://trac.roundcube.net/changeset/2148http://trac.roundcube.net/ticket/1485618http://trac.roundcube.net/changeset/2148http://trac.roundcube.net/ticket/1485618https://www.exploit-db.com/exploits/7549https://www.exploit-db.com/exploits/7553

    Related CVEs

    CVE-2026-75010 (CVSS 6.4) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could lea…
    CVE-2026-75007 (CVSS 5.4) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via…
    CVE-2026-75006 (CVSS 5.8) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitizat…
    CVE-2026-75004 (CVSS 4.3) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesiev…
    CVE-2026-75003 (CVSS 5.8) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG …
    CVE-2026-75002 (CVSS 7.1) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronizati…
    CVE-2026-75000 (CVSS 5.8) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "…
    CVE-2026-74999 (CVSS 5.4) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to sto…
    CVE-2026-74998 (CVSS 7.2) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) pro…
    CVE-2026-74997 (CVSS 8.8) — In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is su…

    References

    http://mahara.org/interaction/forum/topic.php?id=533
    http://osvdb.org/53893
    http://secunia.com/advisories/33145
    http://secunia.com/advisories/33170
    http://secunia.com/advisories/34789
    http://sourceforge.net/forum/forum.php?forum_id=898542
    http://trac.roundcube.net/changeset/2148
    http://trac.roundcube.net/ticket/1485618
    http://www.openwall.com/lists/oss-security/2008/12/12/1
    http://www.securityfocus.com/archive/1/499489/100/0/threaded
    http://www.vupen.com/english/advisories/2008/3418
    http://www.vupen.com/english/advisories/2008/3419
    https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a
    https://www.exploit-db.com/exploits/7549
    https://www.exploit-db.com/exploits/7553
    https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html
    https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html
    http://mahara.org/interaction/forum/topic.php?id=533
    http://osvdb.org/53893
    http://secunia.com/advisories/33145
    http://secunia.com/advisories/33170
    http://secunia.com/advisories/34789
    http://sourceforge.net/forum/forum.php?forum_id=898542
    http://trac.roundcube.net/changeset/2148
    http://trac.roundcube.net/ticket/1485618
    http://www.openwall.com/lists/oss-security/2008/12/12/1
    http://www.securityfocus.com/archive/1/499489/100/0/threaded
    http://www.vupen.com/english/advisories/2008/3418
    http://www.vupen.com/english/advisories/2008/3419
    https://github.com/PHPMailer/PHPMailer/commit/8beacc646acb67c995aea10ac5585970efc7355a
    https://www.exploit-db.com/exploits/7549
    https://www.exploit-db.com/exploits/7553
    https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00783.html
    https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00802.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High