PHPMailer 安全漏洞

PHPMailer is a PHP class library for sending emails. PHPMailer has a security vulnerability that can be exploited by remote attackers to execute arbitrary PHP code on the target system...

PT-2021-3321 · Phpmailer · Phpmailer

Name of the Vulnerable Software and Affected Versions: PHPMailer versions prior to 6.5.0 Description: The issue is related to errors in handling the lang path parameter in the setLanguage function of the PHPMailer library. This can allow a remote attacker to execute arbitrary code if the lang pat...

in phpmailer/phpmailer

✍️ Description validateAddress function used to validate email addresses, uses calluserfunc to call the callable from the name of callable provided to the function as an argument $patternselect. But if no argument is passed, the function sets "php" as default value to $patternselect variable on...

PHPMailer code issue vulnerability

PHPMailer is a PHP class library for sending emails. PHPMailer is vulnerable to a code issue that allows object injection via addAttachment with a UNC pathname via Phar deserialization. No details of the vulnerability are currently available...

Vulnerabilities fixed in Wordpress

Wordpress has fixed two vulnerabilities in the standard included PHPMailer module. A remote malicious party can exploit the exploit the vulnerabilities to execute arbitrary code under the application's permissions, potentially gaining access gain access to sensitive information within the scope o...

WordPress Multiple Vulnerabilities (May 2021) - Linux

WordPress is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

WordPress Multiple Vulnerabilities (May 2021) - Windows

WordPress is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for php-phpmailer6 (FEDORA-2021-b21bbfa198)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for php-phpmailer6 (FEDORA-2021-ecf4fed550)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer

Description WordPress versions 3.7 to 5.7.1 were using a vulnerable version of the PHPMailer library, which was affected by a PHP Object Injection vulnerability through Phar Deserialization via addAttachment with a UNC pathname. To fix the vulnerability the PHPMailer library was updated from...

WordPress <= 5.7.1 - Object injection in PHPMailer vulnerability

Object injection in PHPMailer vulnerability discovered in WordPress one security issue affecting WordPress versions between 3.7 and 5.7. Solution Update the WordPress to the latest available version at least 5.7.2. All WordPress versions since 3.7 have also been updated to fix the following...

[SECURITY] Fedora 33 Update: php-phpmailer6-6.4.1-1.fc33

PHPMailer - A full-featured email creation and transfer class for PHP Class Features Probably the world's most popular code for sending email from PHP! Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more Integrated SMTP support - send without a local...

[SECURITY] Fedora 34 Update: php-phpmailer6-6.4.1-1.fc34

PHPMailer - A full-featured email creation and transfer class for PHP Class Features Probably the world's most popular code for sending email from PHP! Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more Integrated SMTP support - send without a local...

GHSA-M298-FH5C-JC66 Object injection in PHPMailer/PHPMailer

Impact This is a reintroduction of an earlier issue CVE-2018-19296 by an unrelated bug fix in PHPMailer 6.1.8. An external file may be unexpectedly executable if it is used as a path to an attachment file via PHP's support for .phar files. Exploitation requires that an attacker is able to provide...

PHPMailer 6.1.8 < 6.4.1 Object Injection Vulnerability

PHPMailer contains an object injection vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Arbitrary Code Execution

phpmailer/phpmailer is vulnerable to arbitrary code execution. An attacker is able to exploit the vulnerability by injecting malicious code via the Phar Deserialization via addAttachment with a UNC pathname...

CVE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

CVE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

Deserialization of untrusted data

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

CVE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...