CVE-2016-10033

UNKNOWN

Published 2016-12-30T19:00:00.000Z

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2016-10033. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1

9.8

/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14

0.945

probability

of exploitation in the wild

There is a 94.5% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25

Exploit Probability

Percentile: 1.000

Higher than 100.0% of all CVEs

Attack Vector Metrics

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Impact Metrics

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Description

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Available Exploits

WordPress PHPMailer < 5.2.18 - Remote Code Execution

WordPress PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property in isMail transport.

ID: CVE-2016-10033

Author: princechaddha Critical

References:

Related News

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2014-3931 Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability CVE-2016-10033 PHPMailer Co…

Cisa.gov 2025-07-07 12:00

Known Exploited Vulnerability

This vulnerability is actively being exploited in the wild

View KEV Details

Remediation Status

Overdue

Due Date

July 28, 2025

Added to KEV

July 7, 2025

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Product

Vendor/Project: PHP

Product: PHPMailer

Ransomware Risk

Known Ransomware Use

KEV Catalog Version: 2025.07.07 Released: July 7, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed CRITICAL

Remote code execution in PHPMailer

GHSA-5f37-gxvh-23v6

Advisory Details

### Impact The `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted `Sender` property. ### Patches Fixed in 5.2.18 ### Workarounds Filter and validate user input before passing it to internal functions. ### References https://nvd.nist.gov/vuln/detail/CVE-2016-10033 Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045 ### For more information If you have any questions or comments about this advisory: * Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

Affected Packages

Packagist phpmailer/phpmailer

ECOSYSTEM: ≥5.0.0 <5.2.18

CVSS Scoring

CVSS Score

9.0

CVSS Vector


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

WEB https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-5f37-gxvh-23v6

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2016-10033

WEB https://www.exploit-db.com/exploits/42221

WEB https://www.exploit-db.com/exploits/42024

WEB https://www.exploit-db.com/exploits/41996

WEB https://www.exploit-db.com/exploits/41962

WEB https://www.exploit-db.com/exploits/40986

WEB https://www.exploit-db.com/exploits/40974

WEB https://www.exploit-db.com/exploits/40970

WEB https://www.exploit-db.com/exploits/40969

WEB https://www.exploit-db.com/exploits/40968

WEB https://www.drupal.org/psa-2016-004

WEB https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html

WEB https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

WEB https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18

PACKAGE https://github.com/PHPMailer/PHPMailer

WEB https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2016-10033.yaml

WEB https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html

WEB http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html

WEB http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html

WEB http://seclists.org/fulldisclosure/2016/Dec/78

WEB http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection

Advisory provided by GitHub Security Advisory Database. Published: March 5, 2020, Modified: April 14, 2025

Social Media Intelligence

Real-time discussions and threat intelligence from social platforms

2 posts

Reddit • 2 months, 3 weeks ago

_cybersecurity_

Exploit

CISA Flags Four Critical Vulnerabilities Amid Rising Threats **CISA has added four serious vulnerabilities to its catalog, warning of active exploitation and urging immediate updates.** **Key Points:** - CISA adds four vulnerabilities to the KEV catalog due to active exploitation. - CVE-2014-3931 and CVE-2016-10033 have CVSS scores of 9.8, indicating …

Also mentions: CVE-2019-9621 CVE-2014-3931

4.0

View Original High Risk

Reddit • 2 months, 3 weeks ago

_cybersecurity_

Critical Command Injection Vulnerability in PHPMailer Under Active Exploitation **A severe command injection vulnerability in PHPMailer, tracked as CVE-2016-10033, poses serious risks as it is actively being exploited in live cyberattacks.** **Key Points:** - CVE-2016-10033 allows arbitrary code execution via command injection in PHPMailer's mail() function. - Active exploitation is …

3.0

View Original