CVE-2015-8476: Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP...

Security readout for executives and security teams

PHPMailer before 5.2.14 could let specially crafted line breaks alter SMTP conversations. For organizations, the business risk is abuse of application email functions, including unauthorized message manipulation, where vulnerable PHPMailer versions handle attacker-controlled email fields. Exposure is most likely in PHP applications or distribution packages that include PHPMailer earlier than 5.2.14, especially where web forms or account workflows pass user-controlled addresses into email-sending code. Prioritize remediation for public-facing applications that send email using PHPMailer. The issue is old and patchable, but legacy PHP systems and bundled libraries can persist unnoticed and create reputational risk through email abuse. Mitigation focus: Upgrade PHPMailer to version 5.2.14 or later.; Apply Debian or Fedora security package updates where PHPMailer is OS-managed.; Inventory bundled PHPMailer copies inside applications and vendor packages..

Prepared

Jun 13, 2026, 21:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.