CVE-2016-10045

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

• CWE-77

• http://openwall.com/lists/oss-security/2016/12/28/1Mailing List, Patch
• http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Dec/81Mailing List, Patch, Third Party Advisory
• http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionExploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/539967/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/95130Exploit, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037533Third Party Advisory, VDB Entry
• https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlThird Party Advisory
• https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20Patch, Vendor Advisory
• https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilitiesPatch, Vendor Advisory
• https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.htmlExploit, Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/40969/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40986/Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/42221/Third Party Advisory, VDB Entry
• http://openwall.com/lists/oss-security/2016/12/28/1Mailing List, Patch
• http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Dec/81Mailing List, Patch, Third Party Advisory
• http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injectionExploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/539967/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/95130Exploit, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037533Third Party Advisory, VDB Entry
• https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.htmlThird Party Advisory
• https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20Patch, Vendor Advisory
• https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilitiesPatch, Vendor Advisory
• https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.htmlExploit, Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/40969/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40986/Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/42221/Third Party Advisory, VDB Entry

Published

Dec 30, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1004Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-10040Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 …
• CVE-2016-10041An issue was discovered in Sprecher Automation SPRECON-E Ser…
• CVE-2016-10042Authorization Bypass in the Web interface of Arcadyan SLT-00…
• CVE-2016-10043An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.…
• CVE-2016-10044The aio_mount function in fs/aio.c in the Linux kernel befor…7.8
• CVE-2016-10046Heap-based buffer overflow in the DrawImage function in magi…
• CVE-2016-10047Memory leak in the NewXMLTree function in magick/xml-tree.c …
• CVE-2016-10048Directory traversal vulnerability in magick/module.c in Imag…
• CVE-2016-10049Buffer overflow in the ReadRLEImage function in coders/rle.c…7.8
• CVE-2016-1005Adobe Flash Player before 18.0.0.333 and 19.x through 21.x b…8.8
• CVE-2016-10050Heap-based buffer overflow in the ReadRLEImage function in c…7.8