CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbit…
Published: 2016-12-30 · CVSS: 9.8 · CVSS 3.1
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7