Phpmailer Project

10 CVEs across 1 Phpmailer Project products. Browse Phpmailer Project vulnerabilities, severities, and proof-of-concept exploits.

Phpmailer Project products with known CVEs

ProductCVEs
Phpmailer10
Phpmailer Project CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2021-3603High8.12021-06-17PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by o…
CVE-2021-34551High8.12021-06-16PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.
CVE-2020-36326Critical9.82021-04-28PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-192…
CVE-2020-13625High7.52020-06-08PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type b…
CVE-2018-19296High8.82018-11-16PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
CVE-2017-11503Medium6.12017-07-20PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.
CVE-2017-5223Medium5.52017-01-16An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email messag…
CVE-2016-10045Critical9.82016-12-30The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary co…
CVE-2016-10033Critical9.82016-12-30The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and conseque…
CVE-2015-84762015-12-16Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address…