Loading vulnerability…
CVE-2021-44026 is a SQL injection vulnerability in Roundcube Webmail affecting versions before 1.3.17 and 1.4.x before 1.4.12. The flaw is exposed through the search and search_params parameters, allowing attacker-controlled input to influence backend SQL queries. Available reporting indicates the issue was used to dump Roundcube database contents during post-XSS exploitation chains, making it useful for reconnaissance and mailbox data collection against vulnerable webmail deployments.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a chained XSS and SQL injection exploit targeting a webmail application (likely Roundcube or similar). The main Python script (exploit_chain_xss_sqli.py) acts as both a C2 server and a tool to send a crafted email containing a base64-encoded JavaScript payload. When the victim opens the email, the payload loads an external JavaScript file (x-fetch-sqli.js) from the attacker's server. This script performs a SQL injection attack via the webmail interface, manipulates session variables, and ultimately exfiltrates sensitive session data (such as session IDs and variables) back to the attacker's C2 server. The repository is structured with a Python server and a JavaScript payload, demonstrating a full attack chain from initial delivery to data exfiltration. The exploit requires the attacker to control an SMTP account and a C2 server, and the target must be vulnerable to both XSS and SQL injection in the webmail interface.
This repository provides a working exploit for Roundcube webmail vulnerabilities CVE-2021-44026 (SQL injection) and CVE-2020-35730 (XSS). The exploit consists of a Python script (exploit.py) that acts as both an email sender and a Flask-based C2 server, and a JavaScript payload (static/fetcher.js) that is delivered to the victim via a crafted email. The attack chain is as follows: (1) The attacker runs exploit.py, which sends a malicious email to the target user. (2) When the target opens the email in a vulnerable Roundcube instance, the embedded XSS payload executes, loading fetcher.js from the attacker's server. (3) fetcher.js performs a SQL injection to extract session variables and emails, then exfiltrates this data as a vCard to the attacker's /store endpoint. The repository is well-structured, with clear separation between the exploit logic (Python) and the client-side payload (JavaScript). The exploit is operational and demonstrates a full attack chain, including exfiltration of sensitive data from the target.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Critical SQL injection vulnerability in Roundcube Webmail used after XSS to dump the Roundcube database and exfiltrate accounts, cached messages, and settings.
A Roundcube webmail vulnerability reportedly abused by APT28 for reconnaissance and data gathering.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.