Skip to content
OpenAdvisories

Package · Packagist

phpmailer/phpmailer

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2020-36326

    Object injection in PHPMailer/PHPMailer

    PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always conside…

    phpmailer/phpmailer libphp-phpmailer Debian Packagist
  • Critical 9.8
    CVE-2016-10045 Public exploit EPSS 98%

    Remote code execution in PHPMailer

    The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping perf…

    phpmailer/phpmailer libphp-phpmailer php5-phpmailer php-phpmailer Ubuntu Alpine Packagist
  • Critical 9.8
    CVE-2016-10033 Exploited Public exploit Scanner template EPSS 100%

    Remote code execution in PHPMailer

    The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

    phpmailer/phpmailer libphp-phpmailer libphp-phpmailer php5-phpmailer Debian Ubuntu Alpine Packagist
    KEV Jul 7, 2025