← Back to browse
·
API
CVE-2021-44026
Severity
CRITICAL
CVSS
9.8
EPSS
0.42751
Risk score
79.16
CISA KEV
Yes
PoC
No
Published
2023-06-22
Modified
2023-06-22
First seen
2026-08-07
Aliases
EUVD-2021-30885, GHSA-5FMQ-JMC8-85RW
Products
Roundcube:Roundcube Webmail, n/a:n/a n/a
Sources
euvd
EUVD-2021-30885
cisa.gov
CVE-2021-44026
Description
Roundcube Webmail is vulnerable to SQL injection via search or search_params.
References
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://nvd.nist.gov/vuln/detail/CVE-2021-44026
https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-30885
https://bugs.debian.org/1000156
https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1
https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/
https://www.debian.org/security/2021/dsa-5013
https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html