Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: PHP FormMail Generator 2016-12-06 Clear all filters
TI-2016-07750 CVE-2016-9484 · GHSA-r29g-5mgx-4588

Path traversal in PHP FormMail Generator

Priority MEDIUM 40

The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04355 Published 2018-07-13 Fixed in 2016-12-06 CWE-22
TI-2016-07749 CVE-2016-9483 · GHSA-jfh9-jwf2-w35r

Deserialization of untrusted data in PHP FormMail Generator

Priority MEDIUM 48

The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03427 Published 2018-07-13 Fixed in 2016-12-06 CWE-502
TI-2016-07748 CVE-2016-9482 · GHSA-mw66-7g34-8744

Improper authentication in PHP FormMail Generator

Priority MEDIUM 49

Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04489 Published 2018-07-13 Fixed in 2016-12-06 CWE-302