{"id":"CVE-2016-10033","published":"2016-12-30T19:59:00Z","modified":"2026-06-17T00:38:55Z","title":"PHPMailer Command Injection Vulnerability","vendor":"PHP","product":"PHPMailer","tier":"core","eol":null,"description":{"text":"The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.","provenance":"source","from":"NVD"},"summary":{"text":"The PHPMailer library (vendor PHP) has a command injection flaw in the mailSend function of its isMail transport in versions before 5.2.18, where the Sender property is not properly neutralised before being passed to the mail command. An unauthenticated remote attacker who can supply a crafted Sender value containing a backslash-double-quote sequence can inject extra parameters into the mail command and execute arbitrary code, with no user interaction or special configuration required beyond the isMail transport being in use.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:47Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99714,"percentile":0.99952,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-07-07","dueDate":"2025-07-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 ; https://github.com/advisories/GHSA-5f37-gxvh-23v6 ; https://nvd.nist.gov/vuln/detail/CVE-2016-10033","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-01-26","exploitedFirstSeen":"2022-01-26","ransomware":false,"evidence":[{"url":"https://www.ic3.gov/Media/News/2022/220126.pdf","date":"2022-01-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-07-07"},{"url":"https://cyble.com/resources/research-reports/global-cybersecurity-report/","date":"2025-12-11"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-88","name":"Improper Neutralization of Argument Delimiters in a Command"},{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2016/Dec/78","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/539963/100/0/threaded","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/95108","tags":["Broken Link","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037533","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html","tags":["Third Party Advisory"]},{"url":"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities","tags":["Patch","Vendor Advisory"]},{"url":"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://www.drupal.org/psa-2016-004","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/40968/","tags":["Exploit","Patch","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40969/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40970/","tags":["Exploit","Patch","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40974/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40986/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41962/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41996/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42024/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42221/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2016/Dec/78","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection","tags":["Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/539963/100/0/threaded","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/95108","tags":["Broken Link","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037533","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html","tags":["Third Party Advisory"]},{"url":"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities","tags":["Patch","Vendor Advisory"]},{"url":"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://www.drupal.org/psa-2016-004","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/40968/","tags":["Exploit","Patch","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40969/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40970/","tags":["Exploit","Patch","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40974/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40986/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41962/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/41996/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42024/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42221/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[],"affected":[{"ecosystem":"Packagist","package":"phpmailer/phpmailer","vulnerableRanges":[">=5.0.0, <5.2.18"],"patched":["5.2.18"],"from":["GHSA-5f37-gxvh-23v6"],"provenance":"source"}],"advisories":[{"id":"GHSA-5f37-gxvh-23v6","url":"https://github.com/advisories/GHSA-5f37-gxvh-23v6","severity":"CRITICAL","ecosystem":"Packagist","package":"phpmailer/phpmailer","vulnerableRanges":[">=5.0.0, <5.2.18"],"patched":["5.2.18"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2020-0331","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0331","exploited":true,"exploitedSince":"2025-07-07","provenance":"source"},"exploits":[{"id":40968,"url":"https://www.exploit-db.com/exploits/40968","title":"PHPMailer < 5.2.18 - Remote Code Execution","type":"webapps","platform":"php","date":"2016-12-26","verified":true,"provenance":"source"},{"id":40969,"url":"https://www.exploit-db.com/exploits/40969","title":"PHPMailer < 5.2.20 - Remote Code Execution","type":"webapps","platform":"php","date":"2016-12-27","verified":false,"provenance":"source"},{"id":40970,"url":"https://www.exploit-db.com/exploits/40970","title":"PHPMailer < 5.2.18 - Remote Code Execution","type":"webapps","platform":"php","date":"2016-12-25","verified":false,"provenance":"source"},{"id":40974,"url":"https://www.exploit-db.com/exploits/40974","title":"PHPMailer < 5.2.18 - Remote Code Execution","type":"webapps","platform":"php","date":"2016-12-29","verified":false,"provenance":"source"},{"id":40986,"url":"https://www.exploit-db.com/exploits/40986","title":"PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution","type":"webapps","platform":"php","date":"2017-01-02","verified":false,"provenance":"source"},{"id":41962,"url":"https://www.exploit-db.com/exploits/41962","title":"WordPress Core 4.6 - Remote Code Execution","type":"webapps","platform":"linux","date":"2017-05-03","verified":false,"provenance":"source"},{"id":41996,"url":"https://www.exploit-db.com/exploits/41996","title":"Vanilla Forums < 2.3 - Remote Code Execution","type":"remote","platform":"php","date":"2017-05-11","verified":false,"provenance":"source"},{"id":42024,"url":"https://www.exploit-db.com/exploits/42024","title":"WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit)","type":"remote","platform":"php","date":"2017-05-17","verified":true,"provenance":"source"},{"id":42221,"url":"https://www.exploit-db.com/exploits/42221","title":"PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution","type":"webapps","platform":"php","date":"2017-06-21","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":9,"earliest":"2016-12-25"},"pocGithub":{"count":15,"skipped":2,"earliest":"2016-12-26","earliestUrl":"https://github.com/opsxcq/exploit-CVE-2016-10033","repos":[{"name":"opsxcq/exploit-CVE-2016-10033","url":"https://github.com/opsxcq/exploit-CVE-2016-10033","stars":409,"created":"2016-12-26"},{"name":"GeneralTesler/CVE-2016-10033","url":"https://github.com/GeneralTesler/CVE-2016-10033","stars":9,"created":"2017-05-10"},{"name":"Zenexer/safeshell","url":"https://github.com/Zenexer/safeshell","stars":8,"created":"2016-12-29"},{"name":"0x00-0x00/CVE-2016-10033","url":"https://github.com/0x00-0x00/CVE-2016-10033","stars":6,"created":"2018-02-09"},{"name":"pedro823/cve-2016-10033-45","url":"https://github.com/pedro823/cve-2016-10033-45","stars":2,"created":"2017-11-19"}]},"metasploit":[{"name":"PHPMailer Sendmail Argument Injection","module":"exploit/multi/http/phpmailer_arg_injection","type":"exploit","disclosureDate":"2016-12-26","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb"},{"name":"WordPress PHPMailer Host Header Command Injection","module":"exploit/unix/webapp/wp_phpmailer_host_header","type":"exploit","disclosureDate":"2017-05-03","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb"}],"nuclei":[{"id":"CVE-2016-10033","name":"WordPress PHPMailer < 5.2.18 - Remote Code Execution","severity":"critical","path":"http/cves/2016/CVE-2016-10033.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10033.yaml"}],"first":{"date":"2016-12-25","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/40970"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html","http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html","http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection","http://www.securityfocus.com/bid/95108","https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html","https://www.exploit-db.com/exploits/40968/","https://www.exploit-db.com/exploits/40969/","https://www.exploit-db.com/exploits/40970/","https://www.exploit-db.com/exploits/40974/","https://www.exploit-db.com/exploits/40986/","https://www.exploit-db.com/exploits/41962/","https://www.exploit-db.com/exploits/41996/","https://www.exploit-db.com/exploits/42024/","https://www.exploit-db.com/exploits/42221/","https://www.exploit-db.com/exploits/42221","https://www.exploit-db.com/exploits/42024","https://www.exploit-db.com/exploits/41996","https://www.exploit-db.com/exploits/41962","https://www.exploit-db.com/exploits/40986","https://www.exploit-db.com/exploits/40974","https://www.exploit-db.com/exploits/40970","https://www.exploit-db.com/exploits/40969","https://www.exploit-db.com/exploits/40968"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059.004"],"provenance":"source"}],"timeline":[{"date":"2016-12-25","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-40970); later: PoC-in-GitHub 2016-12-26, Metasploit 2016-12-26","url":"https://www.exploit-db.com/exploits/40970","provenance":"source"},{"date":"2016-12-30","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10033","provenance":"source"},{"date":"2022-01-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.ic3.gov/Media/News/2022/220126.pdf","provenance":"source"},{"date":"2025-07-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-07-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0331","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":3111},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1737 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"14 NVD references tagged Exploit; 9 Exploit-DB entries; 9 advisory exploit references; 15 PoC-in-GitHub repos; 2 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-phpmailer-cve-2016-10033","children":[{"from":"CVE-2016-10033","to":"CVE-2016-10045","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.","from":"CVE.org","in":"CVE-2016-10045"},{"kind":"version-step","provenance":"source","package":"Packagist:phpmailer/phpmailer","fromFixed":"5.2.18","toFixed":"5.2.20","daysApart":0},{"kind":"similar","provenance":"machine","score":0.53,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2006-5734","published":"2006-11-06","fixed":"5.2.0","kev":false},{"cve":"CVE-2008-5619","published":"2008-12-17","fixed":"5.2.10","kev":false},{"cve":"CVE-2015-8476","published":"2015-12-16","fixed":"5.2.14","kev":false,"link":{"from":"CVE-2015-8476","to":"CVE-2016-10033","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmailer/phpmailer","fromFixed":"5.2.14","toFixed":"5.2.18","daysApart":380}]}},{"cve":"CVE-2016-10033","published":"2016-12-30","fixed":"5.2.18","kev":true},{"cve":"CVE-2016-10045","published":"2016-12-30","fixed":"5.2.20","kev":false},{"cve":"CVE-2017-5223","published":"2017-01-16","fixed":"5.2.22","kev":false},{"cve":"CVE-2017-11503","published":"2017-07-20","fixed":"5.2.24","kev":false}],"package":"Packagist:phpmailer/phpmailer"}}