CVE-2016-10033
highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.997 · 100 %ileexploit · functionalEURUUSadded 2025-07-07remediate by 2025-07-28
required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS · scored 2026-10-26
PHPMailer Command Injection Vulnerability
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
ATT&CK techniques
ATT&CK techniques this enables or maps to.
- T1190Exploit Public-Facing Applicationexploitation
- T1059.004Unix Shellprimary impact
exploits (28)
Public proof-of-concept and weaponised exploit code.
- EDB-40968PHPMailer < 5.2.18 - Remote Code Executionfunctional · exploit_db
- EDB-42024WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit)functional · exploit_db
- EDB-40969PHPMailer < 5.2.20 - Remote Code ExecutionPoC · exploit_db
- EDB-40970PHPMailer < 5.2.18 - Remote Code ExecutionPoC · exploit_db
- EDB-40974PHPMailer < 5.2.18 - Remote Code ExecutionPoC · exploit_db
affected products (8)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-5f37-gxvh-23v6Remote code execution in PHPMailer2020-03-05ghsa · osvUS
### Impact The `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted `Sender` property. ### Patches Fixed in 5.2.18 ### Workarounds Filter and validate user input before passing it to internal functions. ### References https://nvd.nist.gov/vuln/detail/CVE-2016-10033 Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045 ### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (65)
External citations — patches, advisories, analysis.
- http://seclists.org/fulldisclosure/2016/Dec/78cnnvd
- http://www.rapid7.com/db/modules/exploit/multi/cnnvd
- http://www.securityfocus.com/archive/1/539963/100/0/threadedcnnvd
- http://www.securitytracker.com/id/1037533cnnvd
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlcnnvd
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18cnnvd
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilitiescnnvd
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan