Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

spencer14420/sp-php-email-handler

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7PackagistPublished

    SPEmailHandler-PHP has Potential Abuse for Sending Arbitrary Emails

    CVE-2024-53860 · GHSA-mj5r-x73q-fjw6

    Affected
    • Packagist spencer14420/sp-php-email-handler < 1.0.0
    Fixed in
    1.0.0· Vendor fix available
    Issue
    Impact Messages sent using this script are vulnerable to abuse, as the script allows anybody to specify arbitrary email recipients and include user-provided content in confirmation emails. This could enable malicious actors to use your server to send spam, phishing emails, or other malicious content, potentially damaging your domain's reputation and leading to blacklisting by email providers. Patches Patched in version 1.0.0 by removing user-provided content from confirmation emails. All pre-release versions (alpha and beta) are vulnerable to this issue and should not be used. Workarounds There are no workarounds for this issue. Users must upgrade to version 1.0.0 to mitigate the vulnerability.

    Recommended action: Upgrade to 1.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →