Summary
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
- Vendor
- PHP
- Product
- PHPMailer
- Added to KEV
- Jul 7, 2025
- Remediation due
- Jul 28, 2025 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-77, CWE-88
- EPSS
- 99.7% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References