https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T03:57:57.741578+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-11542 bdu:2025-11542 2026-10-05T03:57:57.842005+00:00 bdu:2025-11542 https://cve.radiocsirt.org/vuln/cnvd-2016-13107 cnvd-2016-13107 2026-10-05T03:57:57.842043+00:00 cnvd-2016-13107 https://cve.radiocsirt.org/vuln/euvd-2026-256367 EUVD-2026-256367 2026-10-05T03:57:57.842059+00:00 EUVD-2026-256367 https://cve.radiocsirt.org/vuln/fkie_cve-2016-10033 fkie_cve-2016-10033 2026-10-05T03:57:57.842071+00:00

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

 https://cve.radiocsirt.org/vuln/ghsa-5f37-gxvh-23v6 GHSA-5f37-gxvh-23v6 — Remote code execution in PHPMailer 2026-10-05T03:57:57.842101+00:00

Affected: Packagist: phpmailer/phpmailer

### Impact The `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted `Sender` property.

### Patches Fixed in 5.2.18

### Workarounds Filter and validate user input before passing it to internal functions.

### References https://nvd.nist.gov/vuln/detail/CVE-2016-10033 Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045

### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

 https://cve.radiocsirt.org/vuln/gsd-2016-10033 gsd-2016-10033 2026-10-05T03:57:57.842133+00:00 gsd-2016-10033 https://cve.radiocsirt.org/vuln/ubuntu-cve-2016-10033 UBUNTU-CVE-2016-10033 2026-10-05T03:57:57.842145+00:00

Affected: Ubuntu:Pro:16.04:LTS: libphp-phpmailer

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.