phpmailer project kayıtları
phpmailer project üreticisine ait 10 yayımlanmış kayıt. Bunların 1 tanesi sahada sömürüldü (CISA KEV listesinde), 2 tanesi için hazır saldırı aracı var.
Araştırmacı profili
- KEV’e giren
- 1 · %10
- Silahlaştırılmış
- 2 · %20
- Pre-auth RCE
- 3
- Düzeltme kaydı olan
- %100
- Yayından KEV’e ortanca
- 3111 gün
Pre-auth RCE: saldırganın hesabı olmadan, ağ üzerinden kod çalıştırabildiği açıklar. Yayından KEV’e ortanca: sahada sömürülen kayıtların yayımlanmasıyla CISA listesine girmesi arasındaki tipik süre.
Tekrar eden sınıflar
- CWE-502 Deserialization of Untrusted Data2
- CWE-20 Improper Input Validation1
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-434 Unrestricted Upload of File with Dangerous Type1
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
10 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | EPSS · Yayın |
|---|---|---|---|---|
99Hemen | CVE-2016-10033Silahlaştırılmış | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail cphpmailer project · phpmailer · CWE-88 | Kritik9,8KEV | %99,730 Ara 2016 |
68Bu hafta | CVE-2016-10045Silahlaştırılmış | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently ephpmailer project · phpmailer · CWE-77 | Kritik9,8 | %97,730 Ara 2016 |
40Planlayın | CVE-2020-36326İstismar yok | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname.phpmailer project · phpmailer · CWE-502 | Kritik9,8 | %3,027 Nis 2021 |
36İzleyin | CVE-2018-19296İstismar yok | PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.phpmailer project · phpmailer · CWE-502 | Yüksek8,8 | %2,216 Kas 2018 |
33İzleyin | CVE-2021-34551İstismar yok | PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.phpmailer project · phpmailer · CWE-434 | Yüksek8,1 | %2,816 Haz 2021 |
33İzleyin | CVE-2021-3603İstismar yok | Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailerphpmailer project · phpmailer · CWE-829 | Yüksek8,1 | %2,217 Haz 2021 |
31İzleyin | CVE-2020-13625İstismar yok | PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character.phpmailer project · phpmailer · CWE-116 | Yüksek7,5 | %3,78 Haz 2020 |
25İzleyin | CVE-2017-11503Kavram kanıtı | PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.phpmailer project · phpmailer · CWE-79 | Orta6,1 | %2,420 Tem 2017 |
23İzleyin | CVE-2017-5223Kavram kanıtı | An issue was discovered in PHPMailer before 5.2.22.phpmailer project · phpmailer · CWE-200 | Orta5,5 | %2,116 Oca 2017 |
21İzleyin | CVE-2015-8476İstismar yok | Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in adebian · debian linux · CWE-20 | Orta5,0 | %1,916 Ara 2015 |
- CVE-2016-1003399Hemen
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail c
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99phpmailer project · phpmailer30 Ara 2016
- CVE-2016-1004568Bu hafta
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently e
KritikCVSS 9,8SilahlaştırılmışEPSS %97phpmailer project · phpmailer30 Ara 2016
- CVE-2020-3632640Planlayın
PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname.
KritikCVSS 9,8İstismar yokEPSS %3phpmailer project · phpmailer27 Nis 2021
- CVE-2018-1929636İzleyin
PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
YüksekCVSS 8,8İstismar yokEPSS %2phpmailer project · phpmailer16 Kas 2018
- CVE-2021-3455133İzleyin
PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.
YüksekCVSS 8,1İstismar yokEPSS %2phpmailer project · phpmailer16 Haz 2021
- CVE-2021-360333İzleyin
Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer
YüksekCVSS 8,1İstismar yokEPSS %2phpmailer project · phpmailer17 Haz 2021
- CVE-2020-1362531İzleyin
PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character.
YüksekCVSS 7,5İstismar yokEPSS %3phpmailer project · phpmailer8 Haz 2020
- CVE-2017-1150325İzleyin
PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.
OrtaCVSS 6,1Kavram kanıtıEPSS %2phpmailer project · phpmailer20 Tem 2017
- CVE-2017-522323İzleyin
An issue was discovered in PHPMailer before 5.2.22.
OrtaCVSS 5,5Kavram kanıtıEPSS %2phpmailer project · phpmailer16 Oca 2017
- CVE-2015-847621İzleyin
Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in a
OrtaCVSS 5,0İstismar yokEPSS %1debian · debian linux16 Ara 2015