CVE-2016-10033

🗓️ 30 Dec 2016 19:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 11 Media mentions👁 846 Views🌐 WEB

PHPMailer before 5.2.18 allows remote code execution via crafted Sender propert

Reporter	Title	Published	Views	Family All 182
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	10 May 201712:01	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	26 Mar 202613:28	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	10 May 201703:18	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	24 Jul 202610:28	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	9 Feb 201814:53	–	githubexploit
GithubExploit	Exploit for Argument Injection in Phpmailer_Project Phpmailer	26 Dec 201613:39	–	githubexploit
zdt	PHPMailer 5.2.17 - Remote Code Execution Exploit	26 Dec 201600:00	–	zdt
zdt	PHPMailer < 5.2.18 Remote Code Execution Vulnerability	26 Dec 201600:00	–	zdt
zdt	PHPMailer 5.2.20 - Remote Code Execution Exploit	28 Dec 201600:00	–	zdt
zdt	PHPMailer 5.2.18 - Remote Code Execution (Python) Exploit	29 Dec 201600:00	–	zdt

NVD

Node

Node

Node

joomla joomla!Range1.5.0–3.6.5

Source	Link
exploit-db	www.exploit-db.com/exploits/40969/
exploit-db	www.exploit-db.com/exploits/40986/
drupal	www.drupal.org/psa-2016-004
exploit-db	www.exploit-db.com/exploits/41962/
github	www.github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
legalhackers	www.legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
exploit-db	www.exploit-db.com/exploits/40968/
exploit-db	www.exploit-db.com/exploits/42024/
securityfocus	www.securityfocus.com/archive/1/539963/100/0/threaded
exploit-db	www.exploit-db.com/exploits/41996/

Parameter	Position	Path	Description	CWE
Host	header	vanilla2-3/entry/passwordrequest	CVE-2016-10033 RCE through PHPMailer and host header injection affecting Vanilla Forums <= 2.3; attacker-controlled Host header enables code execution via mail command invocation.	CWE-88

17 Jun 2026 00:38Current

9.8High risk

Vulners AI Score9.8

CVSS 27.5

CVSS 3.19.8

EPSS0.99714

SSVC