Critical

DATE	CVE	VULNERABILITY TITLE	RISK
2021-04-28	CVE-2020-36326	Deserialization of Untrusted Data vulnerability in multiple products PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. network low complexity phpmailer-project wordpress CWE-502 critical	9.8
2016-12-30	CVE-2016-10045	Command Injection vulnerability in multiple products The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. network low complexity phpmailer-project wordpress joomla CWE-77 critical	9.8
2016-12-30	CVE-2016-10033	Argument Injection or Modification vulnerability in multiple products The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property. network low complexity phpmailer-project wordpress joomla CWE-88 critical	9.8