CVE-2016-9483

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 to perform local file inclusion attacks and obtain files from the server.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-94847.5The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform CVE-2016-94857.8On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable CVE-2016-94867.8On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable CVE-2016-94877.8EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who sup CVE-2016-94889.8ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated CVE-2016-94898.8In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, inclu CVE-2016-94906.1ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applicat CVE-2016-94914.9ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most l CVE-2016-94929.8The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to unrestricted upload of dangerous file types. In the CVE-2016-94936.1The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.l CVE-2016-94946.5Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validatio CVE-2016-94958.8Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials. Access to the device's de