CVE-2016-10045

9.8

CRITICALCVSS v3

Published

December 30, 2016

CVSS v2

7.5 HIGH

Affected

6 projects

Assigned by

MITRE

Severity scale

010

Description

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

WordPress/WordPress

GitHubWordPress, Git-ified. This repository is just a mirror of the WordPress subversion repository. Please do not send pull requests. Submit pull requests to https://github.com/WordPress/wordpress-develop and patches to https://core.trac.wordpress.org/ instead.

<= 4.7NVD

PHPMailer/PHPMailer

GitHubThe classic email sending library for PHP

< 5.2.20NVD

auth0/wordpress

More on this CVE

NVD↗GitHub Advisory↗

GitHubWordPress Plugin for Auth0 Authentication

<= 4.7NVD

wordpress

NPMA client for working with WordPress.

<= 4.7NVD

wordpress

RubyGemsThe Wordpress gem provides posting to a Wordpress.com blog or a self hosted wordpress by providing your username, password, login url(if you host your blog) and your blog content. With this gem, you have access to add a text entry on Wordpress blog by providing these options: title text, body text, and a tag array. You must include at least title text or body text with your post. Posting images with posts, posting only images and pulling down your posts will be available very soon.

<= 4.7NVD

joomla

Docker HubJoomla! is an open source content management system.

>= 1.5.0, <= 3.6.5NVD

Security Advisories

CVE-2016-10045

Description

More on this CVE