KEVIntel

CVE-2016-10033

Confirmed PUBLISHED

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command...

PHPMailer · PHPMailer

1 day faster than CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales
Confidence
Confirmed
Exploitation Status
Exploited in the wild
Observed in Sensors
No
Attempts (30d)
—
Unique Attacker IPs
—
CISA KEV
In CISA KEV
CVSS / EPSS
9.8 Critical EPSS 99.7%

At a Glance

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

nuclei_scanner cisa php
CVE Published
Dec 30, 2016
Exploitation Reported
Jun 01, 2026
CVSS
9.8 Critical
EPSS
99.7%
Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor Product Version Status
n/a
n/a

n/a

 Affected

CVE References

  • 42221 exploit-db.com · Exploit https://www.exploit-db.com/exploits/42221/
  • 40969 exploit-db.com · Exploit https://www.exploit-db.com/exploits/40969/
  • 41962 exploit-db.com · Exploit https://www.exploit-db.com/exploits/41962/
  • 40968 exploit-db.com · Exploit https://www.exploit-db.com/exploits/40968/
  • 40974 exploit-db.com · Exploit https://www.exploit-db.com/exploits/40974/
Show 16 more references

Recommended Actions

  • Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
  • Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
  • Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.