UNK_MassTraction

Search everything

Mentions · 7d0
Mentions · 30d0
All mentions2
First seenSep 25, 2026
Last mentionedSep 28, 2026

Timeline

2 articles · newest first

Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild

Pre-authentication Roundcube SQL injection CVE-2026-48842 is now exploited against unpatched webmail servers.

Security AffairsSep 28, 05:50 UTC · Sep 28, 2026Exploit / PoCExploitedCVE-2026-48842 CVE-2025-49113 CVE-2025-684614

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

Roundcube pre-auth SQL injection CVE-2026-48842 is being exploited, Canadian cyber authorities warned.

The Hacker NewsSep 25, 10:14 UTC · Sep 25, 2026Exploit / PoCExploitedCVE-2026-48842 CVE-2025-49113 CVE-2025-684612 · 2 reads

Related CVEs

by mentions

CVE-2025-49113100%8.8
Authenticated PHP Object Deserialization RCE in Roundcube Webmail
published Jun 2, 2025Roundcube WebmailKEVPoC ×2
CVE-2025-6846127%6.1
Cross-Site Scripting via SVG animate Tag in Roundcube Webmail
published Dec 18, 2025Roundcube WebmailKEV
CVE-2026-488422%8.1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash…
published May 25, 2026PoC ×3

Appears with

CISAorganization · 2
Roundcubevendor · 2
VShellmalware · 2
Canadian Centre for Cyber Securityorganization · 2
Roundcube Webmailproduct · 2
SentinelOneorganization · 2
Shadowserver Foundationorganization · 1
Proofpointorganization · 1

Entities are extracted by the model from each article. First seen Sep 25, 2026, last mentioned Sep 28, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.