OMENWAVE modelled vulnerability-chaining pathways

CVE-2020-35730

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

6.1
CVSS Medium
32.9%
EPSS p98
YES
In CISA KEV

Data as of 2 Nov 2026 · NVD, CISA KEV, EPSS

Why chaining, at machine speed

Defenders still triage vulnerabilities one CVE at a time, while increasingly automated attackers combine them at machine speed. Omenwave models the plausible pathways by which this CVE could be chained with others — surfacing them for research and awareness, with evidence for each step.

Modelled capability profile
Kill-chain stage
CRED_ACCESS
Requires
NONE access, NETWORK vector, user interaction
Grants
NONE access
Capabilities
credential accessinformation disclosuredata tampering
Model confidence
high · CVSS 3.1
Top plausible next hops
CVE-2025-49113CRED_ACCESS → EXECUTIONhigh plausibility · KEV

The source discloses credential material, which can satisfy the destination's authentication requirement.

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is n…

CVE-2021-39144CRED_ACCESS → PRIV_ESChigh plausibility · KEV

The source discloses credential material, which can satisfy the destination's authentication requirement.

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has suffi…

CVE-2023-5631CRED_ACCESS → CRED_ACCESShigh plausibility · KEV

The source discloses credential material, which can satisfy the destination's authentication requirement.

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because…

CVE-2020-13671CRED_ACCESS → EXECUTIONhigh plausibility · KEV

The source discloses credential material, which can satisfy the destination's authentication requirement.

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and…

CVE-2019-1003030CRED_ACCESS → PRIV_ESCmedium plausibility · KEV

The source discloses credential material, which can satisfy the destination's authentication requirement.

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cp…

Open in the interactive explorer →
Embed this snapshot

Paste this into a blog post or report — it renders a compact, exploit-free chain snapshot.

Modelled plausible chaining potential derived from public CVE metadata (CVSS, CWE, CPE). Not a confirmed real-world exploit chain and contains no exploitation detail. For research and awareness only.

Methodology · Interactive explorer · JSON: /cve/CVE-2020-35730