CVE-2016-10033

🗓️ 30 Dec 2016 19:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 11 Media mentions👁 783 Views🌐 WEB

PHPMailer before 5.2.18 allows remote code execution via crafted Sender propert

Reporter	Title	Published	Views	Family All 167
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	10 May 201712:01	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	26 Mar 202613:28	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	10 May 201703:18	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	9 Feb 201814:53	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	26 Dec 201613:39	–	githubexploit
0day.today	PHPMailer 5.2.17 - Remote Code Execution Exploit	26 Dec 201600:00	–	zdt
0day.today	PHPMailer < 5.2.18 Remote Code Execution Vulnerability	26 Dec 201600:00	–	zdt
0day.today	PHPMailer 5.2.20 - Remote Code Execution Exploit	28 Dec 201600:00	–	zdt
0day.today	PHPMailer 5.2.18 - Remote Code Execution (Python) Exploit	29 Dec 201600:00	–	zdt
0day.today	PHPMailer Sendmail Argument Injection Exploit	4 Jan 201700:00	–	zdt

NVD

Node

Node

Node

joomla joomla!Range1.5.0–3.6.5

Source	Link
exploit-db	www.exploit-db.com/exploits/40969/
exploit-db	www.exploit-db.com/exploits/40986/
drupal	www.drupal.org/psa-2016-004
exploit-db	www.exploit-db.com/exploits/41962/
github	www.github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
legalhackers	www.legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
exploit-db	www.exploit-db.com/exploits/40968/
exploit-db	www.exploit-db.com/exploits/42024/
securityfocus	www.securityfocus.com/archive/1/539963/100/0/threaded
exploit-db	www.exploit-db.com/exploits/41996/

Parameter	Position	Path	Description	CWE
service	request body	core/admin/modules/developer/email/update.php	PHPMailer Sender handling flaw enables remote code execution via unsafely propagated Sender value; CSRF can trigger update to set a crafted bigtree_from leading to PHPMailer::send() using an attacker-controlled value.	CWE-88
bigtree_from	request body	core/admin/modules/developer/email/update.php	PHPMailer Sender handling flaw enables remote code execution via unsafely propagated Sender value; CSRF can trigger update to set a crafted bigtree_from leading to PHPMailer::send() using an attacker-controlled value.	CWE-88

17 Jun 2026 00:38Current

9.8High risk

Vulners AI Score9.8

CVSS 27.5

CVSS 3.19.8

EPSS0.99714

SSVC