This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails...
9.8CVSS9.6AI score0.02303EPSS
SaveExploits1References4
Mend•added 2017/01/31 10:00 p.m.•4 views
CVE-2016-9411
The Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails...
