https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 07:28:52 +0000 https://cve.radiocsirt.org/vuln/bdu:2019-01248 bdu:2019-01248 https://cve.radiocsirt.org/vuln/bdu:2019-01248 https://cve.radiocsirt.org/vuln/certfr-2021-avi-378 certfr-2021-avi-378 https://cve.radiocsirt.org/vuln/certfr-2021-avi-378 https://cve.radiocsirt.org/vuln/euvd-2026-69631 EUVD-2026-69631 https://cve.radiocsirt.org/vuln/euvd-2026-69631 https://cve.radiocsirt.org/vuln/fkie_cve-2018-19296 <p>PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.</p> <p>PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-19296 https://cve.radiocsirt.org/vuln/ghsa-7w4p-72j7-v7c2 <p><strong>Affected:</strong> Packagist: phpmailer/phpmailer</p> <p>PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing phar:// paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.</p> <p>### Impact Object injection, possible remote code execution</p> <p>### Patches Fixed in 6.0.6 and 5.2.27</p> <p>### Workarounds Validate and sanitise user input before using.</p> <p>### References https://nvd.nist.gov/vuln/detail/CVE-2018-19296</p> <p>### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)</p> <p><strong>Affected:</strong> Packagist: phpmailer/phpmailer</p> <p>PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing phar:// paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.</p> <p>### Impact Object injection, possible remote code execution</p> <p>### Patches Fixed in 6.0.6 and 5.2.27</p> <p>### Workarounds Validate and sanitise user input before using.</p> <p>### References https://nvd.nist.gov/vuln/detail/CVE-2018-19296</p> <p>### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)</p> https://cve.radiocsirt.org/vuln/ghsa-7w4p-72j7-v7c2 https://cve.radiocsirt.org/vuln/gsd-2018-19296 gsd-2018-19296 https://cve.radiocsirt.org/vuln/gsd-2018-19296 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-19296 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: libphp-phpmailer, Ubuntu:18.04:LTS: libphp-phpmailer</p> <p>PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: libphp-phpmailer, Ubuntu:18.04:LTS: libphp-phpmailer</p> <p>PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-19296