Known vulnerabilities in PHPMailer

Software: PHPMailer
Software CPE: cpe:2.3:a:phpmailer_sourceforge_net:phpmailer:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 10
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting PHPMailer PHPMailer is affected by 10 known vulnerabilities: 5 high, 2 medium, 3 low Critical High Medium Low

Vulnerabilities (10)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU80107 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
6.8.1 29.08.2023 SB2023082934
SB2023082948
SB2023082949
and 1 more
#VU54171 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-3603
CWE-94 High
No
No
6.5.0 16.06.2021 SB2021061620
SB2021070506
SB2022032104
and 4 more
#VU54170 - Improper input validation
CVE-2021-34551
CWE-20 Medium
No
No
6.5.0 16.06.2021 SB2021061620
SB2021070506
SB2022032104
and 2 more
#VU52850 - Deserialization of Untrusted Data
CVE-2020-36326
CWE-502 High
No
No
6.4.1 04.05.2021 SB2021050416
SB2021053118
SB2022032104
and 2 more
#VU29531 - Improper input validation
CVE-2020-13625
CWE-20 Low
No
No
6.1.6 06.07.2020 SB2020070602
SB2020072602
SB2020072603
and 10 more
#VU16334 - Improper input validation
CVE-2018-19296
CWE-20 High
No
No
5.2.27, 6.0.6 07.12.2018 SB2018120727
SB2018120728
SB2019061106
and 12 more
#VU7653 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-11503
CWE-79 Low
No
No
- 02.08.2017 SB2017062503
SB2023031539
SB2023031540
and 5 more
#VU4756 - Exposure of sensitive information to an unauthorized actor
CVE-2017-5223
CWE-200 Medium
Available
No
- 16.01.2017 SB2017011603
SB2023031539
SB2023031540
and 3 more
#VU3119 - Improper Control of Generation of Code ('Code Injection')
CVE-2016-10045
CWE-94 High
Available
No
- 03.01.2017 SB2016122801
SB2017010304
SB2017011503
and 11 more
#VU3118 - Improper Control of Generation of Code ('Code Injection')
CVE-2016-10033
CWE-94 High
Available
Exploited
- 30.12.2016 SB2016122601
SB2017011503
SB2017011120
and 14 more