Vulnerabilitycritical
Vanilla Forums software is still affected by a critical remote code execution zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-10033 | Command Injection RCE in PHPMailer (Ships with WordPress and Joomla) | 9.8 | 100% | KEVPoC ×14 | KEV |
| CVE-2016-10045 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary… | 9.8 | 98% | PoC ×6 | |
| CVE-2016-10073 | The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and… | 7.5 | 84% | PoC ×3 |
From the original article
2 min read at securityaffairs.comThe popular Vanilla Forums software is still affected by a critical remote code execution zero-day first reported to the development team in December 2016. The exploit code was published by ExploitBox, a remote attacker can chain the flaw with the Host Header injection vulnerability CVE-2016-10073 to execute arbitrary code and take the control of the affected software.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.