-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability manifests in SendmailSend function where user-controlled Sender property is directly interpolated into a shell command string without proper escaping. Multiple sources (CVE description, PHPMailer advisory, and vTiger exploit analysis) explicitly show the vulnerable code pattern: 'sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender)' without using escapeshellarg/cmd. This allows attackers to inject commands via Sender parameter when sendmail transport is used.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmailer/phpmailer | composer | < 1.7.4 | 1.7.4 |
Ongoing coverage of React2Shell