{"schema":"threatline.record/2","record":{"id":"CVE-2016-10033","aliases":[],"summary":"PHPMailer Command Injection Vulnerability","details":"PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.","categories":["Runtimes & languages"],"product":"PHPMailer","vendor":"PHP","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2016-10033","source_modified_at":"2025-10-21T23:55:47.202Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}],"defaultStatus":null}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":true,"date_added":"2025-07-07","due_date":"2025-07-28","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.99714,"percentile":0.99953,"score_date":"2026-10-23"},"published_at":"2016-12-30T19:00:00.000Z","modified_at":"2025-10-21T23:55:47.202Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2016-10033","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:55:47.202Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2016-12-26"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2017-05-03"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/40968","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2016-12-26"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/40970","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2016-12-25"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/40974","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2016-12-29"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/40969","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2016-12-27"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/40986","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2017-01-02"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/42221","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2017-06-21"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/41996","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2017-05-11"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/41962","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2017-05-03"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/42024","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2017-05-17"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10033.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-10033","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","Exploit-DB","Nuclei","EPSS"],"references":[{"url":"https://github.com/advisories/GHSA-5f37-gxvh-23v6","source":"CISA KEV"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10033","source":"CISA KEV"},{"source":"CVE List","url":"https://www.drupal.org/psa-2016-004","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/42221/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/40969/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/41962/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/40968/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/40974/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/40986/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/40970/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/41996/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/42024/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2025-07-17T03:55:44.949090Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"PHPMailer Sendmail Argument Injection","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmailer_arg_injection.rb","date":"2016-12-26","added":"2025-06-23","check":false},{"source":"Metasploit","kind":"Exploit module","name":"WordPress PHPMailer Host Header Command Injection","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_phpmailer_host_header.rb","date":"2017-05-03","added":"2026-04-22","check":true},{"source":"Exploit-DB","kind":"Webapps exploit","name":"PHPMailer < 5.2.18 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/40968","date":"2016-12-26","added":"2016-12-26","verified":true},{"source":"Exploit-DB","kind":"Webapps exploit","name":"PHPMailer < 5.2.18 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/40970","date":"2016-12-25","added":"2016-12-28","verified":false},{"source":"Exploit-DB","kind":"Webapps exploit","name":"PHPMailer < 5.2.18 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/40974","date":"2016-12-29","added":"2016-12-29","verified":false},{"source":"Exploit-DB","kind":"Webapps exploit","name":"PHPMailer < 5.2.20 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/40969","date":"2016-12-27","added":"2016-12-28","verified":false},{"source":"Exploit-DB","kind":"Webapps exploit","name":"PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution","url":"https://www.exploit-db.com/exploits/40986","date":"2017-01-02","added":"2017-01-02","verified":false},{"source":"Exploit-DB","kind":"Webapps exploit","name":"PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution","url":"https://www.exploit-db.com/exploits/42221","date":"2017-06-21","added":"2017-06-21","verified":false},{"source":"Exploit-DB","kind":"Remote exploit","name":"Vanilla Forums < 2.3 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/41996","date":"2017-05-11","added":"2017-05-12","verified":false},{"source":"Exploit-DB","kind":"Webapps exploit","name":"WordPress Core 4.6 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/41962","date":"2017-05-03","added":"2017-05-04","verified":false},{"source":"Exploit-DB","kind":"Remote exploit","name":"WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit)","url":"https://www.exploit-db.com/exploits/42024","date":"2017-05-17","added":"2017-05-17","verified":true},{"source":"Nuclei","kind":"Scanner template","name":"WordPress PHPMailer < 5.2.18 - Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10033.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2025-10-21T23:55:47.202Z","content_hash":"793d5f1ea03043a52e2b966b05db8bf720d8c46324cbb04d74529ead89c6f7da"}}