CVE-2016-10033
- State
- Published
- Severity
- 9.8 Critical
- Published
- Dec 30, 2016
- Updated
- Oct 21, 2025
- Reserved
- Dec 22, 2016
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html
- https://www.drupal.org/psa-2016-004
- 42221exploit
- 40969exploit
- 41962exploit
- 40968exploit
- https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
- https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]mailing-list
- https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities
- http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html
- 40974exploit
- 40986exploit
- 40970exploit
- http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
- 41996exploit
- 20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]mailing-list
- 95108vdb-entry
- 1037533vdb-entry
- https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html
- 42024exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.