{"id":"CVE-2012-0796","aliases":["DSA-2421-1","EUVD-2022-7002","GHSA-398j-f7m7-795j"],"status":"published","title":"PHPMailer vulnerable to email header injection","description":"class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01677,"percentile":0.77037,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2012-02-29T00:00:00Z","modified":"2026-06-16T23:38:16Z","fixes":[{"ecosystem":"Packagist","package":"phpmailer/phpmailer","fixed_in":["2.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmailer/phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9.dfsg2-2.1+squeeze3"}]}],"versions":["1.9.9.dfsg2-2.1","1.9.9.dfsg2-2.1+squeeze1","1.9.9.dfsg2-2.1+squeeze2"],"bundled":11},{"source":"osv","ecosystem":"Packagist","package":"phpmailer/phpmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1"}]}]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://moodle.org/mod/forum/discuss.php?d=194015","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=62988bf0bbc73df655f51884aaf1f523928abff9","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.debian.org/security/2012/dsa-2421","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=783532","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-398j-f7m7-795j","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0796","tags":["advisory"]},{"url":"https://git.moodle.org/gw?p=moodle.git\u0026a=commit\u0026h=62988bf0bbc73df655f51884aaf1f523928abff9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-398j-f7m7-795j"},{"url":"https://github.com/PHPMailer/PHPMailer","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2012-0796","description":"class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.","status":"published","published":"2012-07-17T10:00:00Z","modified":"2024-08-06T18:38:14.388Z","updated_at":"2026-11-02T14:34:52.638543Z"}],"euvd":[{"id":"EUVD-2022-7002","description":"class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.","status":"published","published":"2012-07-17T10:00:00Z","modified":"2024-08-06T18:38:14Z","updated_at":"2026-11-03T01:56:19.818597Z"}],"ghsa":[{"id":"GHSA-398j-f7m7-795j","title":"PHPMailer vulnerable to email header injection","description":"### Impact\nArbitrary additional email headers can be injected via crafted From or Sender headers.\n\n### Patches\nFixed in 2.2.1\n\n### Workarounds\nFilter user-supplied values prior to using them in From or Sender properties.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-0796\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)","status":"published","published":"2022-10-06T21:25:46Z","modified":"2023-10-25T13:56:18Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:09.438703Z"}],"nvd":[{"id":"CVE-2012-0796","description":"class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.","status":"published","published":"2012-07-17T10:20:53.053Z","modified":"2026-06-16T23:38:16.64Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:14.774945Z"}],"osv":[{"id":"DSA-2421-1","title":"moodle - several","status":"published","published":"2012-02-29T00:00:00Z","modified":"2026-03-09T01:18:58.815903Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"GHSA-398j-f7m7-795j","title":"PHPMailer vulnerable to email header injection","description":"### Impact\nArbitrary additional email headers can be injected via crafted From or Sender headers.\n\n### Patches\nFixed in 2.2.1\n\n### Workarounds\nFilter user-supplied values prior to using them in From or Sender properties.\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-0796\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)","status":"published","published":"2022-10-06T21:25:46Z","modified":"2023-11-08T03:57:02.744137Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}