CVE-2016-10033
PHPMailer Command Injection Vulnerability
9.8
CVSS 3.1
99.7 %
EPSS (current)
2025-07-07
KEV addition
No
Ransomware
Timeline
Publication, first public exploit and KEV addition on a day axis.
Key facts
Vendor / product: PHP / PHPMailer
Published: 2016-12-30 · Due (CISA): 2025-07-28
CWE: CWE-88 · EU list: no
Exploit references (metadata only)
| Source | Reference | Title | Date |
|---|---|---|---|
| nuclei | http/cves/2016/CVE-2016-10033.yaml | WordPress PHPMailer < 5.2.18 - Remote Code Execution | – |
| exploitdb | 40970 | PHPMailer < 5.2.18 - Remote Code Execution | 2016-12-25 |
| exploitdb | 40968 | PHPMailer < 5.2.18 - Remote Code Execution | 2016-12-26 |
| metasploit | exploit/multi/http/phpmailer_arg_injection | exploit/multi/http/phpmailer_arg_injection | 2016-12-26 |
| exploitdb | 40969 | PHPMailer < 5.2.20 - Remote Code Execution | 2016-12-27 |
| exploitdb | 40974 | PHPMailer < 5.2.18 - Remote Code Execution | 2016-12-29 |
| exploitdb | 40986 | PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution | 2017-01-02 |
| exploitdb | 41962 | WordPress Core 4.6 - Remote Code Execution | 2017-05-03 |
| metasploit | exploit/unix/webapp/wp_phpmailer_host_header | exploit/unix/webapp/wp_phpmailer_host_header | 2017-05-03 |
| exploitdb | 41996 | Vanilla Forums < 2.3 - Remote Code Execution | 2017-05-11 |
| exploitdb | 42024 | WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit) | 2017-05-17 |
| exploitdb | 42221 | PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution | 2017-06-21 |
References only — no downloads or instructions.