Security Advisory

CVE-2026-48842

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-25 19:06:37

Last updated 2026-06-03 21:03:52

Assigner mitre

CVSS score 8.1

State PUBLISHED

Description

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

← Browse all CVEs View on cve.org ↗