Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Roundcube Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vuln - CVE-2026-48842 - Vulnerability Database
Roundcube

Roundcube Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vuln - CVE-2026-48842

Low
Reference: CVE-2026-48842
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-48842
Title: Roundcube Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vuln
Overview:

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.