SecurityThe Hacker Newsabout 2 hours ago
Roundcube Pre-Auth SQL Injection Actively Exploited
2 min read
Canada's Cyber Centre warns that CVE-2026-48842, a pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin, is being exploited in the wild. The flaw, rated 8.1, affects versions before 1.6.16 and 1.7.1, patched in May 2026. Attackers can inject SQL without authentication, potentially exposing mail credentials and stored messages.
Level
Hype check
Tap to vote and see what everyone thinks.