CVE-2021-44026

Published Nov 19, 2021 CVSS 3.1 · 9.8 Critical EPSS 69.9% KEV · Listed
Description
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2840-1 roundcube security update
Debian DSA Debian DSA DSA-5013-1 roundcube security update
Ubuntu USN Ubuntu USN USN-5182-1 Roundcube Webmail vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.68079}

epss

{'score': 0.68761}

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2023-06-22'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Oct 21, 2025, 11:25 PM
Reserved
Nov 19, 2021, 12:00 AM
Status
Analyzed
Published
Nov 19, 2021, 4:15 AM
Modified
Jun 17, 2026, 4:11 AM