CVE-2017-15806

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Nov 15, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-158088.8In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.CVE-2017-158096.1In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.CVE-2017-158106.1The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.CVE-2017-158115.4The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admiCVE-2017-158126.1The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.CVE-2017-158139.8In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overflow can occur CVE-2017-158144.4In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in msm_flash_subdev_do_ioctlCVE-2017-158159.8In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a potential buffer overflow CVE-2017-158177.8In all Qualcomm products with Android releases from CAF using the Linux kernel, when an access point sends a challenge text greater than 128CVE-2017-158187.8In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while loading a user applicationCVE-2017-158207.8In all Qualcomm products with Android releases from CAF using the Linux kernel, in a KGSL IOCTL handler, a Use After Free Condition can poteCVE-2017-158217.8In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function wma_p2p_noa_