We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Reserved 2016-12-22 | Published 2016-12-30 | Updated 2025-07-07 | Assigner mitreDate added 2025-07-07 | Due date 2025-07-28
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
packetstormsecurity.com/...-Sendmail-Argument-Injection.html
www.exploit-db.com/exploits/42221/ (42221)
www.exploit-db.com/exploits/40969/ (40969)
www.exploit-db.com/exploits/41962/ (41962)
www.exploit-db.com/exploits/40968/ (40968)
legalhackers.com/...emote-Code-Exec-CVE-2016-10033-Vuln.html
github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18
www.securityfocus.com/archive/1/539963/100/0/threaded (20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033])
github.com/...-2016-10033-and-CVE-2016-10045-vulnerabilities
packetstormsecurity.com/...Mailer-Remote-Code-Execution.html
www.exploit-db.com/exploits/40974/ (40974)
www.exploit-db.com/exploits/40986/ (40986)
www.exploit-db.com/exploits/40970/ (40970)
www.rapid7.com/...exploit/multi/http/phpmailer_arg_injection
www.exploit-db.com/exploits/41996/ (41996)
seclists.org/fulldisclosure/2016/Dec/78 (20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033])
www.securityfocus.com/bid/95108 (95108)
www.securitytracker.com/id/1037533 (1037533)
developer.joomla.org/...205-phpmailer-security-advisory.html
www.exploit-db.com/exploits/42024/ (42024)
Support options