onyx --cves cve-2018-19296
CVE-2018-19296
- score
- <0.1
- cvss
- 8.8
- epss
- 2.2%
- published
- 2018-11-16
- kev added
- —
- first seen
PHPMailer before 5.2.27 and 6.x before 6.0.6 contain an object injection caused by improper handling of unserialized data, letting attackers execute arbitrary code, exploit requires sending malicious serialized data.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 6
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27
- https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6
- https://lists.debian.org/debian-lts-announce/2018/12/msg00020.html
- https://www.debian.org/security/2018/dsa-4351
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT/