CVE-2012-5537

The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron...

CVE-2012-5537

The vulnerability CVE-2012-5537 affects the Simplenews Scheduler module for Drupal (6.x-2.x series) prior to 6.x-2.4. An authenticated user with the 'send scheduled newsletters' permission can inject arbitrary PHP code into the scheduling form, which is later executed by cron, enabling code execu...

SA-CONTRIB-2012-146 - Simplenews Scheduler - Arbitrary code execution

The Simplenews Scheduler module provides a system for creating automatic email newsletters. These can be set to be sent at a fixed interval, or PHP code can be entered to evaluate a condition for a new newsletter issue to be sent. The module allows a user with the 'send scheduled newsletters'...