01 Record

CVE-2016-10034

The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 38.43% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 98.5% of scored records. A rank, not a probability.
NVD base score: 9.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2016-12-30 19:00Z9 YR AGO

Last updated

2024-08-06 03:07Z2 YR AGO

Reserved

2016-12-23

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')Class

Data version

5.1

Document digest

8f4515648763f30d8a39716372a112be4e4ee319d491a27b4d003848b4d6bc7b

05 Affected products

VendorProductVersionsPlatforms

zendzend-mailNot specified—

zendzend_frameworkNot specified—

06 References

security.gentoo.orgGLSA-201804-10https://security.gentoo.org/glsa/201804-10vendor-advisoryx_refsource_GENTOO
www.exploit-db.com42221https://www.exploit-db.com/exploits/42221/exploitx_refsource_EXPLOIT-DB
framework.zend.comhttps://framework.zend.com/security/advisory/ZF2016-04x_refsource_CONFIRM
legalhackers.comhttps://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.htmlx_refsource_MISC
www.exploit-db.com40979https://www.exploit-db.com/exploits/40979/exploitx_refsource_EXPLOIT-DB
www.securitytracker.com1037539http://www.securitytracker.com/id/1037539vdb-entryx_refsource_SECTRACK
www.exploit-db.com40986https://www.exploit-db.com/exploits/40986/exploitx_refsource_EXPLOIT-DB
www.securityfocus.com95144http://www.securityfocus.com/bid/95144vdb-entryx_refsource_BID