Read the docs
TI-2016-07758 Aliases CVE-2016-9492GHSA-2wvx-75wc-hc4w

PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file types

Priority MEDIUM 48CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename.

Why it matters now

EPSS 0.03332 88th percentileScored 2026-11-07
Fix Fixed Generator (PHP FormMail): 17/12/2016

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP FormMailGenerator17/12/2016 to before 17/12/201617/12/2016Patch availableCNA
  • Generator VendorPHP FormMail Affected 17/12/2016 to before 17/12/2016 Fixed in 17/12/2016 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jqueryform:php_formmail_generator:*:*:*:*:*:*:*:*before 2016-12-17VulnerablePHP FormMail
  • cpe:2.3:a:jqueryform:php_formmail_generator:*:*:*:*:*:*:*:* Versions before 2016-12-17 Vulnerable ·PHP FormMail

Remediation

  • Fix · CNA Generator (PHP FormMail) Fixed in 17/12/2016

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHP FormMail Generator 17/12/2016

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2016-07759 PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scriptingPriority LOW 30
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9492
  2. 2026-10-03 Alias added: GHSA-2wvx-75wc-hc4w

References

Advisory 1

  • TI-2016-07748 Improper authentication in PHP FormMail Generator CVSS 3.0CRITICAL 9.8
  • TI-2016-07749 Deserialization of untrusted data in PHP FormMail Generator CVSS 3.0CRITICAL 9.8
  • TI-2016-07750 Path traversal in PHP FormMail Generator CVSS 3.0HIGH 7.5
  • TI-2016-07759 PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences