PatchTheCVEphpmailer vulnerabilities and fixes
Recent CVEs affecting phpmailer, with upgrade or downgrade steps. 10 tracked.
phpmailer has 10 tracked vulnerabilities, 3 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 9. Most recent: 2021-06-17. Highest priority: CVE-2016-10033 (score 97/100).
- CVE-2021-3603 HIGH 8.1 UPGRADE MITIGATE PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such co
- CVE-2021-34551 HIGH 8.1 UPGRADE MITIGATE PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pa
- CVE-2020-36326 CRITICAL 9.8 UPGRADE UPGRADE PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UN
- CVE-2020-13625 HIGH 7.5 UPGRADE MITIGATE PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double qu
- CVE-2018-19296 HIGH 8.8 UPGRADE MITIGATE PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
- CVE-2017-5223 MEDIUM 5.5 UPGRADE An issue was discovered in PHPMailer before 5.2.22
- CVE-2017-11503 MEDIUM 6.1 DOWNGRADE PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.
- CVE-2016-10045 CRITICAL 9.8 UPGRADE UPGRADE The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the m
- CVE-2016-10033 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE PHPMailer Command Injection Vulnerability
- CVE-2015-8476 MEDIUM 5.0 MITIGATE UPGRADE Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP co
FAQ
How do I fix phpmailer vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is phpmailer being exploited right now?
Yes: 1 phpmailer CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which phpmailer CVE should I patch first?
CVE-2016-10033 currently ranks highest (97/100): PHPMailer Command Injection Vulnerability.