ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More · 2h Silent Lynx Exploitat WinRAR Vitium ad Instruendum Reverse Shell in Attacis Regni CIS · 5h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 8h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 8h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 9h Vulnerabilitas in software Sparx Systems Enterprise Architect · 9h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 9h Vulnerabilitates in Slican telephonis · 10h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 13h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 14h ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More · 2h Silent Lynx Exploitat WinRAR Vitium ad Instruendum Reverse Shell in Attacis Regni CIS · 5h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 8h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 8h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 9h Vulnerabilitas in software Sparx Systems Enterprise Architect · 9h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 9h Vulnerabilitates in Slican telephonis · 10h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 13h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 14h

ACyber Sentinel Turma Aestimationis Securitatis

← Redire

⚡ Renuntiatio

Vulnerabilitas SQL Injection in Roundcube Webmail ab impetibus abutitur

📰 security.nl 🕐 Sep 25, 2026 11:31 ⏱ 1 minuta lectio ⚠️ 1 CVE

Vulnerabilitas SQL Injection in Roundcube ab impetibus abutitur. Id indicat Centrum Canadense pro Cybersecuritate. Roundcube est software webmail open-source et a variis organizationibus per orbem terrarum adhibetur. Software saepius telorum impetuum fit. Per hanc vulnerabilitatem (CVE-2026-48842) impugnator non authentificatus accessum ad database Roundcube obtinere potest. Nulla interactio ab usoribus requiritur ad abutendum vulnerabilitate.

Finis Maii quaestio in versionibus 1.6.16 et 1.7.1 emendata est. Nunc Centrum Canadense pro Cybersecuritate nuntiat vulnerabilitatem in impetibus adhibitam esse. Singula de his impetibus non data sunt. Fundatio Shadowserver circiter 523.000 Roundcube-servers in interrete numerat. Quam multa ex his vulnerabilia sint, tamen incognitum est. Initio huius anni agency cybernetica Americana CISA de abusu vulnerabilitatis cross-site scripting (XSS) in Roundcube Webmail monuit.

Vulnerabilitates Relatae

CVE-2026-48842 CVSS 8.1 HIGH Deferred

CVE-2026-48842 - Roundcube Webmail SQL Injection

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.