Most recent entries from all

bdu:2025-11542

cnvd-2016-13107

EUVD-2026-256367

fkie_cve-2016-10033

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

GHSA-5f37-gxvh-23v6 — Remote code execution in PHPMailer

Affected: Packagist: phpmailer/phpmailer

### Impact The `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted `Sender` property.

### Patches Fixed in 5.2.18

### Workarounds Filter and validate user input before passing it to internal functions.

### References https://nvd.nist.gov/vuln/detail/CVE-2016-10033 Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045

### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

gsd-2016-10033

UBUNTU-CVE-2016-10033

Affected: Ubuntu:Pro:16.04:LTS: libphp-phpmailer