{
    "id": "CVE-2016-10033",
    "published": "2016-12-30 19:59:00",
    "last_modified": "2026-06-17 00:38:55",
    "cvss_score": "9.8",
    "cvss_severity": "CRITICAL",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "cwe": "CWE-88",
    "description": "The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.",
    "epss_score": "0.99714",
    "epss_percentile": "0.99951",
    "kev": 1,
    "kev_due": "2025-07-28",
    "has_exploit": 1,
    "updated_at": "2026-09-26 18:20:50",
    "priority": {
        "rank": 1,
        "label": "Patch first",
        "why": "On CISA KEV — known exploited in the wild, due 2025-07-28."
    },
    "products": [
        {
            "vendor": "joomla",
            "product": "joomla\\!"
        },
        {
            "vendor": "phpmailer_project",
            "product": "phpmailer"
        },
        {
            "vendor": "wordpress",
            "product": "wordpress"
        }
    ],
    "kev_detail": {
        "cve_id": "CVE-2016-10033",
        "date_added": "2025-07-07",
        "due_date": "2025-07-28",
        "vendor": "PHP",
        "product": "PHPMailer",
        "name": "PHPMailer Command Injection Vulnerability",
        "ransomware": 0
    },
    "exploits": [
        {
            "source": "exploit-db",
            "ref_id": "42221",
            "title": "PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution",
            "date": "2017-06-21",
            "url": "https://www.exploit-db.com/exploits/42221"
        },
        {
            "source": "exploit-db",
            "ref_id": "42024",
            "title": "WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit)",
            "date": "2017-05-17",
            "url": "https://www.exploit-db.com/exploits/42024"
        },
        {
            "source": "exploit-db",
            "ref_id": "41996",
            "title": "Vanilla Forums < 2.3 - Remote Code Execution",
            "date": "2017-05-11",
            "url": "https://www.exploit-db.com/exploits/41996"
        },
        {
            "source": "exploit-db",
            "ref_id": "41962",
            "title": "WordPress Core 4.6 - Remote Code Execution",
            "date": "2017-05-03",
            "url": "https://www.exploit-db.com/exploits/41962"
        },
        {
            "source": "exploit-db",
            "ref_id": "40986",
            "title": "PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution",
            "date": "2017-01-02",
            "url": "https://www.exploit-db.com/exploits/40986"
        },
        {
            "source": "exploit-db",
            "ref_id": "40974",
            "title": "PHPMailer < 5.2.18 - Remote Code Execution",
            "date": "2016-12-29",
            "url": "https://www.exploit-db.com/exploits/40974"
        },
        {
            "source": "exploit-db",
            "ref_id": "40969",
            "title": "PHPMailer < 5.2.20 - Remote Code Execution",
            "date": "2016-12-27",
            "url": "https://www.exploit-db.com/exploits/40969"
        },
        {
            "source": "exploit-db",
            "ref_id": "40968",
            "title": "PHPMailer < 5.2.18 - Remote Code Execution",
            "date": "2016-12-26",
            "url": "https://www.exploit-db.com/exploits/40968"
        },
        {
            "source": "exploit-db",
            "ref_id": "40970",
            "title": "PHPMailer < 5.2.18 - Remote Code Execution",
            "date": "2016-12-25",
            "url": "https://www.exploit-db.com/exploits/40970"
        }
    ],
    "refs_list": [
        "http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html",
        "http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html",
        "http://seclists.org/fulldisclosure/2016/Dec/78",
        "http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection",
        "http://www.securityfocus.com/archive/1/539963/100/0/threaded",
        "http://www.securityfocus.com/bid/95108",
        "http://www.securitytracker.com/id/1037533",
        "https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html",
        "https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18",
        "https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities",
        "https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html",
        "https://www.drupal.org/psa-2016-004",
        "https://www.exploit-db.com/exploits/40968/",
        "https://www.exploit-db.com/exploits/40969/",
        "https://www.exploit-db.com/exploits/40970/",
        "https://www.exploit-db.com/exploits/40974/",
        "https://www.exploit-db.com/exploits/40986/",
        "https://www.exploit-db.com/exploits/41962/",
        "https://www.exploit-db.com/exploits/41996/",
        "https://www.exploit-db.com/exploits/42024/",
        "https://www.exploit-db.com/exploits/42221/",
        "http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html",
        "http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html",
        "http://seclists.org/fulldisclosure/2016/Dec/78",
        "http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection"
    ]
}