Read the docs
TI-2016-07759 Aliases CVE-2016-9493GHSA-597c-6vf9-vpc4

PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting

Priority LOW 30CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-80.

Summary

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename.

Why it matters now

EPSS 0.0151 74th percentileScored 2026-11-07
Fix Fixed Generator (PHP FormMail): 17/12/2016

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP FormMailGenerator17/12/2016 to before 17/12/201617/12/2016Patch availableCNA
  • Generator VendorPHP FormMail Affected 17/12/2016 to before 17/12/2016 Fixed in 17/12/2016 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jqueryform:php_formmail_generator:*:*:*:*:*:*:*:*before 2016-12-17VulnerablePHP FormMail
  • cpe:2.3:a:jqueryform:php_formmail_generator:*:*:*:*:*:*:*:* Versions before 2016-12-17 Vulnerable ·PHP FormMail

Remediation

  • Fix · CNA Generator (PHP FormMail) Fixed in 17/12/2016

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHP FormMail Generator 17/12/2016

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2016-07758 PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file typesPriority MEDIUM 48
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9493
  2. 2026-10-03 Alias added: GHSA-597c-6vf9-vpc4

References

Advisory 1

  • TI-2016-07748 Improper authentication in PHP FormMail Generator CVSS 3.0CRITICAL 9.8
  • TI-2016-07758 PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file types CVSS 3.0CRITICAL 9.8
  • TI-2016-07749 Deserialization of untrusted data in PHP FormMail Generator CVSS 3.0CRITICAL 9.8
  • TI-2016-07750 Path traversal in PHP FormMail Generator CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences