https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T22:33:01.884296+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2017-33788 cnvd-2017-33788 2026-10-07T22:33:01.970990+00:00 cnvd-2017-33788 https://cve.radiocsirt.org/vuln/euvd-2026-78806 EUVD-2026-78806 2026-10-07T22:33:01.971042+00:00 EUVD-2026-78806 https://cve.radiocsirt.org/vuln/fkie_cve-2017-15806 fkie_cve-2017-15806 2026-10-07T22:33:01.971070+00:00

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."

 https://cve.radiocsirt.org/vuln/ghsa-hgr8-g756-vmg9 GHSA-hgr8-g756-vmg9 — Zeta Components Mail Arbitrary code execution via a crafted email address 2026-10-07T22:33:01.971121+00:00

Affected: Packagist: zetacomponents/mail

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."

 https://cve.radiocsirt.org/vuln/gsd-2017-15806 gsd-2017-15806 2026-10-07T22:33:01.971163+00:00 gsd-2017-15806