CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 28/04/2021 |
| CVE-2020-13625 | 高7.5 | PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message. | 08/06/2020 |
| CVE-2018-19296 | 高8.8 | PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. | 16/11/2018 |
| CVE-2017-11503 | 中6.1 | PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php. | 20/07/2017 |
| CVE-2017-5223 | 中5.5 | An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, i | 16/01/2017 |
| CVE-2016-10045 | 緊急9.8 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability e | 30/12/2016 |
| CVE-2016-10033KEV | 緊急9.8 | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property. | 30/12/2016 |
| CVE-2015-8476 | 中5.0 | Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-201 | 16/12/2015 |