Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Linked advisories
- CVE-2026-48842Roundcube Webmail: Mehrere Schwachstellen
- CVE-2026-48842Debian roundcube: security update
- CVE-2026-48842debian roundcube: SQL-Injection
- CVE-2026-48842Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash…
- CVE-2026-48842debian roundcube: SQL-Injection
Affected vendors and products
More on Roundcube
Other advisories
- CriticalCVE-2026-54432Roundcube: Mehrere Schwachstellen
- HighCVE-2026-75000Roundcube Webmail: Mehrere Schwachstellen
- MediumCVE-2026-107147The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation…
- MediumCVE-2026-107146The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session …
- MediumCVE-2026-107145The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who…
- HighCVE-2026-113386Roundcube Webmail: Mehrere Schwachstellen
- Not ratedosv:MGASA-2026-0532Updated roundcubemail package fixes security vulnerabilities
- HighCVE-2026-113386Debian roundcube: security update
Other news entries
- Roundcube Webmail: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Roundcube Webmail: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Multiples vulnérabilités dans Roundcube Webmail (19 octobre 2026)NewsCERT-FR (ANSSI)
- Roundcube Webmail Vulnerability in Attackers’ CrosshairsNewsSecurityWeek
- Hackers now exploit critical Roundcube flaw in code injection attacksNewsBleepingComputer
- Roundcube: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Multiples vulnérabilités dans Roundcube Webmail (07 septembre 2026)NewsCERT-FR (ANSSI)
- Roundcube Webmail: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
Source: https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html
ID