Remote code execution in PHPMailer
Affected range
ECOSYSTEM: introduced 5.0.0; fixed 5.2.18>=5.0.0,<5.2.18Fixed versions: 5.2.18
Vulnerability intelligence Composer
phpmailer/phpmailer
PHPMailer is a full-featured email creation and transfer class for PHP
Composer latest 7.1.1 LGPL-2.1-only
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
7.1.1
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
14 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-m298-fh5c-jc66 critical
Object injection in PHPMailer/PHPMailer
Affected range
ECOSYSTEM: introduced 6.1.8; fixed 6.4.1>=6.1.8,<6.4.1Fixed versions: 6.4.1
GHSA-4pc3-96mx-wwc8 critical
Remote code execution in PHPMailer
Affected range
ECOSYSTEM: introduced 5.0.0; fixed 5.2.20>=5.0.0,<5.2.20Fixed versions: 5.2.20
GHSA-f7hx-fqxw-rvvj high
Insufficient output escaping of attachment names in PHPMailer
Affected range
ECOSYSTEM: introduced 0; fixed 6.1.6<6.1.6Fixed versions: 6.1.6
GHSA-v5c9-mmw9-829q high
PHPMailer susceptible to arbitrary code execution
Affected range
ECOSYSTEM: introduced 0; fixed 5.2.10<5.2.10Fixed versions: 5.2.10
GHSA-7w4p-72j7-v7c2 high
Phar object injection in PHPMailer
Affected range
ECOSYSTEM: introduced 5.0.0; fixed 5.2.27ECOSYSTEM: introduced 6.0.0; fixed 6.0.6>=5.0.0,<5.2.27|>=6.0.0,<6.0.6Fixed versions: 5.2.27, 6.0.6
GHSA-77mr-wc79-m8j3 high
PHPMailer untrusted code may be run from an overridden address validator
Affected range
ECOSYSTEM: introduced 0; fixed 6.5.0<6.5.0Fixed versions: 6.5.0
GHSA-7q44-r25x-wm4q high
Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows
Affected range
ECOSYSTEM: introduced 0; fixed 6.5.0<6.5.0Fixed versions: 6.5.0
GHSA-6h78-85v2-mmch high
PHPMailer Shell command injection
Affected range
ECOSYSTEM: introduced 0; fixed 1.7.4<1.7.4Fixed versions: 1.7.4
GHSA-398j-f7m7-795j high
PHPMailer vulnerable to email header injection
Affected range
ECOSYSTEM: introduced 0; fixed 2.2.1<2.2.1Fixed versions: 2.2.1
GHSA-58mj-pw57-4vm2 moderate
Cross-site scripting in PHPMailer
Affected range
ECOSYSTEM: introduced 5.0.0; fixed 5.2.24>=5.0.0,<5.2.24Fixed versions: 5.2.24
GHSA-4x5h-cr29-fhp6 moderate
Local file disclosure in PHPMailer
Affected range
ECOSYSTEM: introduced 5.0.0; fixed 5.2.22>=5.0.0,<5.2.22Fixed versions: 5.2.22
GHSA-8jc3-5p29-qgjx moderate
PHPMailer Local file inclusion
Affected range
ECOSYSTEM: introduced 0; fixed 5.2.0<5.2.0Fixed versions: 5.2.0
SMTP Injection in PHPMailer
Affected range
ECOSYSTEM: introduced 5.0.0; fixed 5.2.14>=5.0.0,<5.2.14Fixed versions: 5.2.14