Roundcube Webmail (< 1.6.20, 1.7.x < 1.7.5)

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize() due to improper handling of session keys prefixed with "!".