{"cve":"CVE-2016-9493","nvd":{"published":"2018-07-13T20:29:01.690","modified":"2026-06-17T00:56:10.077","status":"Modified","description":"The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79","CWE-80"],"references":["http://www.securityfocus.com/bid/96718","https://www.kb.cert.org/vuls/id/608591","http://www.securityfocus.com/bid/96718","https://www.kb.cert.org/vuls/id/608591"],"products":["jqueryform:php_formmail_generator"],"source":"nvd","synced_at":"2026-10-19T20:52:03.425131697+00:00"},"epss":{"cve":"CVE-2016-9493","score":0.0151,"percentile":0.74451,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}