CVE-2016-10033

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

• CWE-88
• CWE-88

• http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Dec/78Mailing List, Patch, Third Party Advisory
• http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionExploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/539963/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/95108Broken Link, Exploit, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037533Broken Link, Third Party Advisory, VDB Entry
• https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlThird Party Advisory
• https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18Patch, Vendor Advisory
• https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilitiesPatch, Vendor Advisory
• https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.htmlExploit, Patch, Third Party Advisory
• https://www.drupal.org/psa-2016-004Third Party Advisory
• https://www.exploit-db.com/exploits/40968/Exploit, Patch, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40969/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40970/Exploit, Patch, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40974/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40986/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/41962/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/41996/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/42024/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/42221/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Dec/78Mailing List, Patch, Third Party Advisory
• http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionExploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/539963/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/95108Broken Link, Exploit, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037533Broken Link, Third Party Advisory, VDB Entry
• https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlThird Party Advisory
• https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18Patch, Vendor Advisory
• https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilitiesPatch, Vendor Advisory
• https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.htmlExploit, Patch, Third Party Advisory
• https://www.drupal.org/psa-2016-004Third Party Advisory
• https://www.exploit-db.com/exploits/40968/Exploit, Patch, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40969/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40970/Exploit, Patch, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40974/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40986/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/41962/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/41996/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/42024/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/42221/Exploit, Third Party Advisory, VDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033US Government Resource

Published

Dec 30, 2016

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10027Race condition in the XMPP library in Smack before 4.1.9, wh…5.9
• CVE-2016-10028The virgl_cmd_get_capset function in hw/display/virtio-gpu-3…5.5
• CVE-2016-10029The virtio_gpu_set_scanout function in QEMU (aka Quick Emula…5.5
• CVE-2016-1003Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-10030The _prolog_error function in slurmd/req.c in Slurm before 1…
• CVE-2016-10031WampServer 3.0.6 installs two services called 'wampapache' a…
• CVE-2016-10034The setFrom function in the Sendmail adapter in the zend-mai…
• CVE-2016-10036Unrestricted file upload vulnerability in ui/artifact/upload…
• CVE-2016-10037Directory traversal in /connectors/index.php in MODX Revolut…7.3
• CVE-2016-10038Directory traversal in /connectors/index.php in MODX Revolut…
• CVE-2016-10039Directory traversal in /connectors/index.php in MODX Revolut…7.3
• CVE-2016-1004Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…