Unscored severity · published Dec 16, 2015
CVE-2015-8476
Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the…
–
CVSS
2%
EPSS
No
On KEV
Description
Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
6.0; 7.0; 8.0 · source: NVD
PH
Phpmailer · Phpmailer Project
through 5.2.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-8476
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-8476
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177130.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177139.html
www.debian.org
http://www.debian.org/security/2015/dsa-3416
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/12/04/5
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/12/05/1
www.securityfocus.com
http://www.securityfocus.com/bid/78619
More from Debian Linux
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability