Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Roundcube Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vuln (CVE-2026-48842) - Vulnerability Database

Roundcube Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vuln (CVE-2026-48842)

Description

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

References

CVE-2026-48842

Related Vulnerabilities

Moodle Other Vulnerability (CVE-2022-30597) Medium
Common tags: Missing Update Known Vulnerabilities
Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-7994) Medium
Common tags: Missing Update Known Vulnerabilities
MongoDb Other Vulnerability (CVE-2020-7928) Medium
Common tags: Missing Update Known Vulnerabilities
MongoDb Other Vulnerability (CVE-2020-7929) Medium
Common tags: Missing Update Known Vulnerabilities
Artifactory CVE-2020-7931 Vulnerability (CVE-2020-7931) High
Common tags: Missing Update Known Vulnerabilities

Severity

Low

Classification

CVE-2026-48842
CWE-138
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update
Known Vulnerabilities