PH
Product
Phpmailer
On CISA KEVExploited in the wild
10
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 4Medium 2Low 0
Watch
Add Phpmailer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-10033 In wildKEV | 9.8 | Dec 30 | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute… Affected: before 5.2.18 |
| CVE-2020-36326 | 9.8 | Apr 28 | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname Affected: 6.1.8 through 6.4.0 |
| CVE-2016-10045 | 9.8 | Dec 30 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging… Affected: before 5.2.20 |
| CVE-2018-19296 | 8.8 | Nov 16 | PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack Affected: before 5.2.27; 6.0.0 before 6.0.6 |
| CVE-2021-3603 | 8.1 | Jun 17 | PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means) Affected: through 6.4.1 |
| CVE-2021-34551 | 8.1 | Jun 16 | PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname Affected: before 6.5.0 |
| CVE-2020-13625 | 7.5 | Jun 8 | PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character Affected: before 6.1.6 |
| CVE-2017-11503 | 6.1 | Jul 20 | PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php Affected: 5.2.23 |
| CVE-2017-5223 | 5.5 | Jan 16 | An issue was discovered in PHPMailer before 5.2.22 Affected: through 5.2.21 |
| CVE-2015-8476 | – | Dec 16 | Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the… Affected: through 5.2.13 |
Showing 10