Launchpad.net

CVE 2018-19296

PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.

See the CVE page on Mitre.org for more details.