PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.
{ "severity": "High", "cpes": [ "cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:*" ] }