CVE-2009-0340: Quirm Simple PHP Newsletter

Medium severity, CVSS 6.8. EPSS: 1.9% chance of exploitation in the next 30 days.

Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the olang parameter to (1) mail.php and (2) mailbar.php.

Affected products

• Quirm Simple PHP Newsletter: version 1.5 only

Published 2009-01-29. Last modified 2026-06-16.