CVE-2021-44026 CISA KEV · Actively exploited
roundcubemail: potential SQL injection via search or search_params.
CVSS score
9.8
EPSS probability
%69.9
Risk score
13.7
Published
4 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
Bug Chain XSS (CVE-2020-35730 and CVE-2023-43770) to SQLi (CVE-2021-44026)
Makefile Go / Python
A demo exploit for CVE-2021-44026, a SQL injection in Roundcube
Makefile Go / Python
Similar Vulnerabilities
9.9
CVE-2025-49113 Actively exploited
roundcubemail: Remote Code Execution in Roundcube via Unvalidated _from Parameter
R
Workaround Public Exploits:12EPSS %99
9.3
CVE-2024-42009 Actively exploited
roundcubemail: A Cross-Site Scripting vulnerability in Roundcube
R
Workaround Public Exploits:7EPSS %83
8.1
CVE-2020-12641 Actively exploited
roundcubemail: remote code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path
R
Workaround Public Exploits:2EPSS %84
6.1
CVE-2020-13965 Actively exploited
roundcubemail: XSS via a malicious XML attachment
R
Workaround Public Exploits:1EPSS %77
5.4
CVE-2023-5631 Actively exploited
roundcube: cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages
R
WorkaroundEPSS %76
7.2
CVE-2020-35730 Actively exploited
roundcubemail: XSS via HTML or plain text messages with malicious content
R
WorkaroundEPSS %33
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2021-44026"