CVE-2008-5619

The record

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.

Affected packages

Related vulnerabilities

• CVE-2017-11503 PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of… Also affects phpmailer/phpmailer
• CVE-2016-10033 The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow… Also affects phpmailer/phpmailer
• CVE-2016-10045 The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass… Also affects phpmailer/phpmailer
• CVE-2025-49113 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by… Also affects roundcube
• CVE-2024-57004 Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote… Also affects roundcube
• CVE-2024-42010 mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters… Also affects roundcube
• CVE-2017-16651 Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows… Also affects roundcube
• CVE-2015-8770 Directory traversal vulnerability in the set_skin function in… Also affects roundcube