{"history":[{"alert":0,"cve":"CVE-2016-10033","id":21548,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.99714, \"percentile\": 0.99952}"},{"alert":0,"cve":"CVE-2016-10033","id":19164,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.99714, \"percentile\": 0.99952}"},{"alert":0,"cve":"CVE-2016-10033","id":17130,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.99714, \"percentile\": 0.99952}"},{"alert":0,"cve":"CVE-2016-10033","id":15193,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.99714, \"percentile\": 0.99952}"},{"alert":0,"cve":"CVE-2016-10033","id":13171,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.99714, \"percentile\": 0.99952}"},{"alert":1,"cve":"CVE-2016-10033","id":12879,"kind":"cna","observed_at":1794046801,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-06T03:07:32.161Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://www.drupal.org/psa-2016-004\"}, {\"name\": \"42221\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/42221/\"}, {\"name\": \"40969\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/40969/\"}, {\"name\": \"41962\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/41962/\"}, {\"name\": \"40968\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/40968/\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18\"}, {\"name\": \"20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]\", \"tags\": [\"mailing-list\", \"x_refsource_BUGTRAQ\", \"x_transferred\"], \"url\": \"http://www.securityfocus.com/archive/1/539963/100/0/threaded\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html\"}, {\"name\": \"40974\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/40974/\"}, {\"name\": \"40986\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/40986/\"}, {\"name\": \"40970\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/40970/\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection\"}, {\"name\": \"41996\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/41996/\"}, {\"name\": \"20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]\", \"tags\": [\"mailing-list\", \"x_refsource_FULLDISC\", \"x_transferred\"], \"url\": \"http://seclists.org/fulldisclosure/2016/Dec/78\"}, {\"name\": \"95108\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"], \"url\": \"http://www.securityfocus.com/bid/95108\"}, {\"name\": \"1037533\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\", \"x_transferred\"], \"url\": \"http://www.securitytracker.com/id/1037533\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html\"}, {\"name\": \"42024\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"], \"url\": \"https://www.exploit-db.com/exploits/42024/\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2016-10033\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2025-07-17T03:55:44.949090Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2025-07-07\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-88\", \"description\": \"CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:55:47.202Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-07-07T00:00:00.000Z\", \"value\": \"CVE-2016-10033 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"n/a\", \"vendor\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"datePublic\": \"2016-12-25T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\\\\\" (backslash double quote) in a crafted Sender property.\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"n/a\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2018-10-09T18:57:01.000Z\", \"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://www.drupal.org/psa-2016-004\"}, {\"name\": \"42221\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/42221/\"}, {\"name\": \"40969\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/40969/\"}, {\"name\": \"41962\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/41962/\"}, {\"name\": \"40968\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/40968/\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18\"}, {\"name\": \"20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]\", \"tags\": [\"mailing-list\", \"x_refsource_BUGTRAQ\"], \"url\": \"http://www.securityfocus.com/archive/1/539963/100/0/threaded\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html\"}, {\"name\": \"40974\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/40974/\"}, {\"name\": \"40986\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/40986/\"}, {\"name\": \"40970\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/40970/\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection\"}, {\"name\": \"41996\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/41996/\"}, {\"name\": \"20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]\", \"tags\": [\"mailing-list\", \"x_refsource_FULLDISC\"], \"url\": \"http://seclists.org/fulldisclosure/2016/Dec/78\"}, {\"name\": \"95108\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"], \"url\": \"http://www.securityfocus.com/bid/95108\"}, {\"name\": \"1037533\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\"], \"url\": \"http://www.securitytracker.com/id/1037533\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html\"}, {\"name\": \"42024\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"], \"url\": \"https://www.exploit-db.com/exploits/42024/\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"cve@mitre.org\", \"ID\": \"CVE-2016-10033\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"n/a\", \"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}}]}, \"vendor_name\": \"n/a\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\\\\\" (backslash double quote) in a crafted Sender property.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html\"}, {\"name\": \"https://www.drupal.org/psa-2016-004\", \"refsource\": \"CONFIRM\", \"url\": \"https://www.drupal.org/psa-2016-004\"}, {\"name\": \"42221\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/42221/\"}, {\"name\": \"40969\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/40969/\"}, {\"name\": \"41962\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/41962/\"}, {\"name\": \"40968\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/40968/\"}, {\"name\": \"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html\", \"refsource\": \"MISC\", \"url\": \"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html\"}, {\"name\": \"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18\", \"refsource\": \"CONFIRM\", \"url\": \"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18\"}, {\"name\": \"20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]\", \"refsource\": \"BUGTRAQ\", \"url\": \"http://www.securityfocus.com/archive/1/539963/100/0/threaded\"}, {\"name\": \"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities\", \"refsource\": \"CONFIRM\", \"url\": \"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities\"}, {\"name\": \"http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html\"}, {\"name\": \"40974\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/40974/\"}, {\"name\": \"40986\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/40986/\"}, {\"name\": \"40970\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/40970/\"}, {\"name\": \"http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection\", \"refsource\": \"MISC\", \"url\": \"http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection\"}, {\"name\": \"41996\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/41996/\"}, {\"name\": \"20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]\", \"refsource\": \"FULLDISC\", \"url\": \"http://seclists.org/fulldisclosure/2016/Dec/78\"}, {\"name\": \"95108\", \"refsource\": \"BID\", \"url\": \"http://www.securityfocus.com/bid/95108\"}, {\"name\": \"1037533\", \"refsource\": \"SECTRACK\", \"url\": \"http://www.securitytracker.com/id/1037533\"}, {\"name\": \"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html\", \"refsource\": \"CONFIRM\", \"url\": \"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html\"}, {\"name\": \"42024\", \"refsource\": \"EXPLOIT-DB\", \"url\": \"https://www.exploit-db.com/exploits/42024/\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"assignerShortName\": \"mitre\", \"cveId\": \"CVE-2016-10033\", \"datePublished\": \"2016-12-30T19:00:00.000Z\", \"dateReserved\": \"2016-12-22T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:55:47.202Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2016-10033","id":10953,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.99714, \"percentile\": 0.99952}"},{"alert":0,"cve":"CVE-2016-10033","id":8699,"kind":"epss","observed_at":1793895600,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.99714, \"percentile\": 0.99952}"},{"alert":0,"cve":"CVE-2016-10033","id":6487,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.99714, \"percentile\": 0.99952}"},{"alert":0,"cve":"CVE-2016-10033","id":4264,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.99714, \"percentile\": 0.99952}"},{"alert":0,"cve":"CVE-2016-10033","id":2046,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.99714, \"percentile\": 0.99952}"},{"alert":1,"cve":"CVE-2016-10033","id":391,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2016-10033\", \"cwes\": [\"CWE-77\", \"CWE-88\"], \"dateAdded\": \"2025-07-07\", \"dueDate\": \"2025-07-28\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 ; https://github.com/advisories/GHSA-5f37-gxvh-23v6 ; https://nvd.nist.gov/vuln/detail/CVE-2016-10033\", \"product\": \"PHPMailer\", \"requiredAction\": \"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\", \"shortDescription\": \"PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.\", \"vendorProject\": \"PHP\", \"vulnerabilityName\": \"PHPMailer Command Injection Vulnerability\"}"}],"record":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T03:07:32.161Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.drupal.org/psa-2016-004"},{"name":"42221","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/42221/"},{"name":"40969","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/40969/"},{"name":"41962","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/41962/"},{"name":"40968","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/40968/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18"},{"name":"20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/539963/100/0/threaded"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html"},{"name":"40974","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/40974/"},{"name":"40986","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/40986/"},{"name":"40970","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/40970/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection"},{"name":"41996","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/41996/"},{"name":"20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2016/Dec/78"},{"name":"95108","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/95108"},{"name":"1037533","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1037533"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html"},{"name":"42024","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/42024/"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2016-10033","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-07-17T03:55:44.949090Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2025-07-07","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-88","description":"CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-21T23:55:47.202Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033"}],"timeline":[{"lang":"en","time":"2025-07-07T00:00:00.000Z","value":"CVE-2016-10033 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-12-25T00:00:00.000Z","descriptions":[{"lang":"en","value":"The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-09T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.drupal.org/psa-2016-004"},{"name":"42221","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/42221/"},{"name":"40969","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/40969/"},{"name":"41962","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/41962/"},{"name":"40968","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/40968/"},{"tags":["x_refsource_MISC"],"url":"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18"},{"name":"20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/539963/100/0/threaded"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html"},{"name":"40974","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/40974/"},{"name":"40986","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/40986/"},{"name":"40970","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/40970/"},{"tags":["x_refsource_MISC"],"url":"http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection"},{"name":"41996","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/41996/"},{"name":"20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2016/Dec/78"},{"name":"95108","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/95108"},{"name":"1037533","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1037533"},{"tags":["x_refsource_CONFIRM"],"url":"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html"},{"name":"42024","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/42024/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2016-10033","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html"},{"name":"https://www.drupal.org/psa-2016-004","refsource":"CONFIRM","url":"https://www.drupal.org/psa-2016-004"},{"name":"42221","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/42221/"},{"name":"40969","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/40969/"},{"name":"41962","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/41962/"},{"name":"40968","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/40968/"},{"name":"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html","refsource":"MISC","url":"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html"},{"name":"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18","refsource":"CONFIRM","url":"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18"},{"name":"20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/539963/100/0/threaded"},{"name":"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities","refsource":"CONFIRM","url":"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities"},{"name":"http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html"},{"name":"40974","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/40974/"},{"name":"40986","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/40986/"},{"name":"40970","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/40970/"},{"name":"http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection","refsource":"MISC","url":"http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection"},{"name":"41996","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/41996/"},{"name":"20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2016/Dec/78"},{"name":"95108","refsource":"BID","url":"http://www.securityfocus.com/bid/95108"},{"name":"1037533","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1037533"},{"name":"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html","refsource":"CONFIRM","url":"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html"},{"name":"42024","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/42024/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2016-10033","datePublished":"2016-12-30T19:00:00.000Z","dateReserved":"2016-12-22T00:00:00.000Z","dateUpdated":"2025-10-21T23:55:47.202Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794046801,"cve":"CVE-2016-10033","description":"The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.","epss":{"date":"2026-11-12","epss":0.99714,"percentile":0.99952},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2016-10033","cwes":["CWE-77","CWE-88"],"dateAdded":"2025-07-07","dueDate":"2025-07-28","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 ; https://github.com/advisories/GHSA-5f37-gxvh-23v6 ; https://nvd.nist.gov/vuln/detail/CVE-2016-10033","product":"PHPMailer","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.","vendorProject":"PHP","vulnerabilityName":"PHPMailer Command Injection Vulnerability"},"kev_checked":1794522003,"products":"n/a n/a","references":["http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html","https://www.drupal.org/psa-2016-004","https://www.exploit-db.com/exploits/42221/","https://www.exploit-db.com/exploits/40969/","https://www.exploit-db.com/exploits/41962/","https://www.exploit-db.com/exploits/40968/","https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html","https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18","http://www.securityfocus.com/archive/1/539963/100/0/threaded","https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities","http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html","https://www.exploit-db.com/exploits/40974/","https://www.exploit-db.com/exploits/40986/","https://www.exploit-db.com/exploits/40970/","http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection","https://www.exploit-db.com/exploits/41996/","http://seclists.org/fulldisclosure/2016/Dec/78","http://www.securityfocus.com/bid/95108","http://www.securitytracker.com/id/1037533","https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html","https://www.exploit-db.com/exploits/42024/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"PHPMailer Command Injection Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}