Back to CVE Browser

CVE-2021-44026

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score29.2880%

EPSS Percentile92.70th

Published2021-11-19

Last Modified2025-11-04

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

Affected Platforms (CPE)

📦

Roundcube

Webmail

< 1.3.17>= 1.4.0 and < 1.4.12

💻

Fedoraproject

Fedora

= 33= 34

💻

Debian

Debian Linux

= 9.0= 10.0= 11.0

References & Advisories

🔗 https://bugs.debian.org/1000156

🔗 https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1

🔗 https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa

🔗 https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html

🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/

🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/

🔗 https://www.debian.org/security/2021/dsa-5013

🔗 https://bugs.debian.org/1000156

Related Vulnerabilities

CVE-2026-544337.2

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text ema...

CVE-2026-544324.7

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the atta...

CVE-2026-626446.4

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username sp...

CVE-2026-626437.2

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail m...