https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:30:38.731623+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2015-12236 bdu:2015-12236 2026-10-03T07:30:38.735898+00:00 bdu:2015-12236 https://cve.radiocsirt.org/vuln/cnvd-2015-08278 cnvd-2015-08278 2026-10-03T07:30:38.735928+00:00 cnvd-2015-08278 https://cve.radiocsirt.org/vuln/euvd-2026-95774 EUVD-2026-95774 2026-10-03T07:30:38.735943+00:00 EUVD-2026-95774 https://cve.radiocsirt.org/vuln/fkie_cve-2015-8476 fkie_cve-2015-8476 2026-10-03T07:30:38.735954+00:00

Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.

 https://cve.radiocsirt.org/vuln/ghsa-738m-f33v-qc2r GHSA-738m-f33v-qc2r — SMTP Injection in PHPMailer 2026-10-03T07:30:38.735981+00:00

Affected: Packagist: phpmailer/phpmailer

### Impact Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.

### Patches Fixed in 5.2.14 in [this commit](https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0).

### Workarounds Manually strip line breaks from email addresses before passing them to PHPMailer.

### References https://nvd.nist.gov/vuln/detail/CVE-2015-8476

### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

 https://cve.radiocsirt.org/vuln/gsd-2015-8476 gsd-2015-8476 2026-10-03T07:30:38.736010+00:00 gsd-2015-8476 https://cve.radiocsirt.org/vuln/ubuntu-cve-2015-8476 UBUNTU-CVE-2015-8476 2026-10-03T07:30:38.736022+00:00

Affected: Ubuntu:14.04:LTS: libphp-phpmailer

Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.