{"uuid": "7485cba8-7fe7-436f-b41c-38fca23e55d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48842", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3305", "content": "\ud83d\udd34 Roundcube Webmail Vulnerability in Attackers\u2019 Crosshairs\n\nThreat actors have been exploiting a high-severity vulnerability in Roundcube, the popular open source webmail client, the Canadian Centre for Cyber Security warns.\n\nTracked as CVE-2026-48842 (CVSS score of 8.1), the security defect is described as an SQL injection in the virtuser_query plugin that can be exploited without authentication.\n\nThe plugin resolves email addresses to mailbox usernames and uses the preg_replace() filter with backslash escaping to neutralize injection attempts.", "creation_timestamp": "2026-09-25T15:06:01.000000Z"}