phpmailer project vulnerabilities

Products

• phpmailer 10

Latest phpmailer project CVEs

Newest publication first

1. CVE-2021-3603 Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer

   Published 2021-06-17

   High·CVSS 8.1 EPSS 2.3% PoC

   PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$va...

2. CVE-2021-34551 Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows

   Published 2021-06-16

   High·CVSS 8.1 EPSS 2.8% PoC

   PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.

3. CVE-2020-36326 Object injection in PHPMailer/PHPMailer

   Published 2021-04-28

   Critical·CVSS 9.8 EPSS 3.1% PoC

   PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHP...

4. CVE-2020-13625 Insufficient output escaping of attachment names in PHPMailer

   Published 2020-06-08

   High·CVSS 7.5 EPSS 3.8%

   PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.

5. CVE-2018-19296 Phar object injection in PHPMailer

   Published 2018-11-16

   High·CVSS 8.8 EPSS 2.2% PoC

   PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.

6. CVE-2017-11503 Cross-site scripting in PHPMailer

   Published 2017-07-20

   Medium·CVSS 6.1 EPSS 2.4% Public exploit PoC

   PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.

7. CVE-2017-5223 Local file disclosure in PHPMailer

   Published 2017-01-16

   Medium·CVSS 5.5 EPSS 2.1% Public exploit PoC

   An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base direct...

8. CVE-2016-10045 Remote code execution in PHPMailer

   Published 2016-12-30

   Critical·CVSS 9.8 EPSS 97.7% Framework module Public exploit PoC

   The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail fun...

9. CVE-2016-10033 Remote code execution in PHPMailer

   Published 2016-12-30

   Critical·CVSS 9.8 EPSS 99.7% CISA KEV added 2025-07-07 Exploited in the wild Framework module Public exploit PoC

   The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property.

10. CVE-2015-8476 SMTP Injection in PHPMailer

    Published 2015-12-16

    Medium·CVSS 5.0 EPSS 2.0% PoC

    Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.