VULNERABILITY INTELLIGENCE
CVE-2016-10033
CVSS score9.8 CRITICAL
EPSS probability99.71%
CISA KEVKnown exploited vulnerability
Published2016-12-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Exploited Vulnerability
PHPMailer Command Injection Vulnerability
Vendor / product: PHP / PHPMailer
Description
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Weakness classification
- CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Primary references
- cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
- cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
- cve@mitre.org — Mailing List, Patch, Third Party Advisory
- cve@mitre.org — Exploit, Third Party Advisory
- cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
- cve@mitre.org — Broken Link, Exploit, Third Party Advisory, VDB Entry
- cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Patch, Vendor Advisory
- cve@mitre.org — Patch, Vendor Advisory
- cve@mitre.org — Exploit, Patch, Third Party Advisory
- cve@mitre.org — Third Party Advisory