CVE-2005-3883: PHP

Medium severity, CVSS 5.0. EPSS: 3.1% chance of exploitation in the next 30 days.

CRLF injection vulnerability in the mb_send_mail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds (LF) in the "To" address argument.

Affected products

• PHP PHP: version 4.0.6 only; version 4.0.7 only; version 4.1.0 only; version 4.1.1 only; version 4.1.2 only; version 4.2 only; …

Published 2005-11-29. Last modified 2026-06-16.