libphp-phpmailer

8 results · Feed

• High 8.1
  CVE-2021-3603

  Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer

  PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defi…

  PHPMailer PHPMailer phpmailer/phpmailer libphp-phpmailer Debian Ubuntu Packagist
  Jun 17, 2021
• High 7.5
  CVE-2020-13625

  Insufficient output escaping of attachment names in PHPMailer

  PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.

  cacti phpmailer/phpmailer libphp-phpmailer libphp-phpmailer Debian Ubuntu Alpine Packagist
  Jun 8, 2020
• High 8.8
  CVE-2018-19296

  Phar object injection in PHPMailer

  PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.

  phpmailer/phpmailer libphp-phpmailer libphp-phpmailer Debian Ubuntu Packagist
  Nov 16, 2018
• Medium 6.1
  CVE-2017-11503 Public exploit

  Cross-site scripting in PHPMailer

  PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.

  phpmailer/phpmailer libphp-phpmailer libphp-phpmailer Debian Ubuntu Packagist
  Jul 20, 2017
• Medium 5.5
  CVE-2017-5223 Public exploit

  Local file disclosure in PHPMailer

  An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script…

  phpmailer/phpmailer libphp-phpmailer libphp-phpmailer Debian Ubuntu Packagist
  Jan 16, 2017
• Critical 9.8
  CVE-2016-10045 Public exploit EPSS 98%

  Remote code execution in PHPMailer

  The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping perf…

  phpmailer/phpmailer libphp-phpmailer php-phpmailer php5-phpmailer Ubuntu Alpine Packagist
  Dec 30, 2016
• Critical 9.8
  CVE-2016-10033 Exploited Public exploit EPSS 100%

  Remote code execution in PHPMailer

  The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

  phpmailer/phpmailer libphp-phpmailer libphp-phpmailer php-phpmailer Debian Ubuntu Alpine Packagist
  Dec 30, 2016

  KEV Jul 7, 2025
• Low —
  CVE-2015-8476

  SMTP Injection in PHPMailer

  Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand funct…

  phpmailer/phpmailer libphp-phpmailer libphp-phpmailer Debian Ubuntu Packagist
  Dec 16, 2015