CVE-2012-0796
PHPMailer vulnerable to email header injection
class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.
Exploit likelihood
What each source reports
NVD Score used
class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.
- Record
CVE-2012-0796- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.
- Record
CVE-2012-0796- Updated
- 2026-11-02
EUVDEUVD-2022-7002 No score
class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.
- Record
EUVD-2022-7002- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-398j-f7m7-795j No score
PHPMailer vulnerable to email header injection
Impact
Arbitrary additional email headers can be injected via crafted From or Sender headers.
Patches
Fixed in 2.2.1
Workarounds
Filter user-supplied values prior to using them in From or Sender properties.
References
https://nvd.nist.gov/vuln/detail/CVE-2012-0796
For more information
If you have any questions or comments about this advisory:
- Open a private issue in the PHPMailer project
- Record
GHSA-398j-f7m7-795j- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-398j-f7m7-795j No score
PHPMailer vulnerable to email header injection
Impact
Arbitrary additional email headers can be injected via crafted From or Sender headers.
Patches
Fixed in 2.2.1
Workarounds
Filter user-supplied values prior to using them in From or Sender properties.
References
https://nvd.nist.gov/vuln/detail/CVE-2012-0796
For more information
If you have any questions or comments about this advisory:
- Open a private issue in the PHPMailer project
- Record
GHSA-398j-f7m7-795j- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmailer/phpmailerPackagist |
before 2.2.1 | 2.2.1 |
moodleDebian:6.0 From an advisory covering 11 CVEs |
before 1.9.9.dfsg2-2.1+squeeze3, plus listed versions 1.9.9.dfsg2-2.11.9.9.dfsg2-2.1+squeeze11.9.9.dfsg2-2.1+squeeze2 |
1.9.9.dfsg2-2.1+squeeze3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-0796 is a medium vulnerability (CVSS 4.0) in Moodle, published February 29, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 77th percentile. Fixed in phpmailer/phpmailer 2.2.1.
References
moodle.org/mod/forum/discuss.php?d=194015
git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=62988bf0bbc73df655f51884aaf1f523928abff9
debian.org/security/2012/dsa-2421
bugzilla.redhat.com/show_bug.cgi?id=783532
github.com/PHPMailer/PHPMailer/security/advisories/GHSA-398j-f7m7-795j
nvd.nist.gov/vuln/detail/CVE-2012-0796