CVE-2016-9484
HIGHjqueryform php_formmail_generator < 2016-12-06 - Unauthenticated Path Traversal and Arbitrary File Read
Title source: llmDescription
The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any PHP form code generated by this website prior to 2016-12-06 may be vulnerable.
References (2)
Core 2
Core References
Third Party Advisory, US Government Resource third-party-advisory
x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/494015
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/94778
Scores
CVSS v3
7.5
EPSS
0.0441
EPSS Percentile
90.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-22
Status
published
Products (1)
jqueryform/php_formmail_generator
< 2016-12-06
Published
Jul 13, 2018
Tracked Since
Feb 18, 2026