CVE-2025-15366

MediumCVSS 5.9/10Last modified Aug 6, 2026

Description

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Metrics

CVSS 4.0 5.9/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Python Software Foundation	CPython	< 3.13.15; >= 3.14.0, < 3.14.7; >= 3.15.0a1, < 3.15.0a6

References

Timeline

Published: Jan 20, 2026
Last modified: Aug 6, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-153675.9The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands CVE-2025-153688.8The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'temp CVE-2025-153695.3The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi CVE-2025-15376.3A vulnerability was found in Harpia DiagSystem 12. It has been rated as critical. This issue affects some unknown processing of the file /di CVE-2025-153704.3The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Referen CVE-2025-153717.8A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G and TEG5328F up to 65.10.15.6. Affected is an unknow CVE-2025-153724.8A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/view CVE-2025-153734.3A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php.CVE-2025-153745.4A vulnerability was detected in EyouCMS up to 1.7.7. The affected element is an unknown function of the file application/home/model/Ask.php CVE-2025-153758.8A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.p CVE-2025-153764.3The Stopwords for comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This CVE-2025-153774.3The Sosh Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is