PHPMailer < 5.2.21 - Local File Disclosure

Exploit Title: PHPMailer SetFrom$POST"your-email", $POST"your-name"; $address = "admin@localhost"; $mail-AddAddress$address, "root"; if isset$POST'cc' $mail-AddCC$POST"your-email", $POST"your-name"; $mail-Subject = "PHPMailer MsgHTML$POST"your-message"; if!$mail-Send echo "Error: ".$mail-ErrorInf...

FreeBSD : phpmailer -- XSS in code example and default exeception handler (c5d79773-8801-11e7-93f7-d43d7e971a1b)

PHPMailer reports : Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The codegenerator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it is explicitly renamed, so it is safe by...

Updated php-phpmailer packages fix security vulnerability

It was discovered that php-phpmailer has a XSS vulnerability in the "From Email Address" and "To Email Address" fields of codegenerator.php CVE-2017-11503...

MGASA-2017-0257 Updated php-phpmailer packages fix security vulnerability

It was discovered that php-phpmailer has a XSS vulnerability in the "From Email Address" and "To Email Address" fields of codegenerator.php CVE-2017-11503...

Fedora 24 : php-PHPMailer (2017-0bc23764e7)

Update to 5.2.24: fixes XSS vulnerability CVE-2017-11503. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

PHPMailer Cross-Site Scripting Vulnerability (CNVD-2017-28411)

PHPMailer is a PHP class library for sending e-mail . A cross-site scripting vulnerability exists in the 'codegenerator.phps' example script in PHPMailer, which stems from the program failing to properly filter HTML code from user input before displaying it. A remote attacker can exploit this...

Fedora Update for php-PHPMailer FEDORA-2017-ab55648aa7

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 26 : php-PHPMailer (2017-ab55648aa7)

Update to 5.2.24: fixes XSS vulnerability CVE-2017-11503. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

[SECURITY] Fedora 26 Update: php-PHPMailer-5.2.24-1.fc26

Full Featured Email Transfer Class for PHP. PHPMailer features: Supports emails digitally signed with S/MIME encryption! Supports emails with multiple TOs, CCs, BCCs and REPLY-TOs Works on any platform. Supports Text & HTML emails. Embedded image support. Multipart/alternative emails for mail...

Fedora Update for php-PHPMailer FEDORA-2017-f838eb0c5e

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for php-PHPMailer FEDORA-2017-0bc23764e7

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 24 Update: php-PHPMailer-5.2.24-1.fc24

Full Featured Email Transfer Class for PHP. PHPMailer features: Supports emails digitally signed with S/MIME encryption! Supports emails with multiple TOs, CCs, BCCs and REPLY-TOs Works on any platform. Supports Text & HTML emails. Embedded image support. Multipart/alternative emails for mail...

Fedora 25 : php-PHPMailer (2017-f838eb0c5e)

Update to 5.2.24: fixes XSS vulnerability CVE-2017-11503. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

[SECURITY] Fedora 25 Update: php-PHPMailer-5.2.24-1.fc25

Full Featured Email Transfer Class for PHP. PHPMailer features: Supports emails digitally signed with S/MIME encryption! Supports emails with multiple TOs, CCs, BCCs and REPLY-TOs Works on any platform. Supports Text & HTML emails. Embedded image support. Multipart/alternative emails for mail...

phpmailer -- XSS in code example and default exeception handler

PHPMailer reports: Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The codegenerator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it is explicitly renamed, so it is safe by...

PHPMailer XSS Vulnerability

PHPMailer is prone to a cross-site scripting vulneragility in the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Multiple CRLF Injection

PHPMailer is vulnerable to multiple CRLF injection attacks. The attacks exist because it does not filter address inputs with line breaks. A malicious user can pass an email address to the validateAddress function in class.phpmailer.php or pass SMTP commands to the sendCommand function in...

Remote Code Execution (RCE)

PHPMailer is vulnerable to remote code execution RCE attacks. A malicious user can inject and execute arbitrary code by passing extra parameters to the mail command. This is due to the improper interaction with the library's escapeshellarg function and internal escaping function performed in PHP...

Local File Inclusion

PHPMailer is vulnerable to local file inclusion. The vulnerability is possible because user supplied relative image URLs are treated as / absolute local file paths and are directly passed to the msgHTML method...

Cross-Site Scripting (XSS)

phpMailer is vulnerable to cross-site scripting XSS attacks. The attacks exist because it does not properly sanitize the user supplied input to the "From Email Address" and "To Email Address" fields of codegenerator.php...