9.8Kritisch KEV

CVE-2016-10033PHPMailer Command Injection Vulnerability

phpmailer project phpmailer; wordpress wordpress; joomla joomla! Veröffentlicht: 2016-12-30 22:00 (vor 9 Jahren)

Bekannt ausgenutzt — PHPMailer Command Injection Vulnerability

CISA hat am 07.07.2025 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 28.07.2025.

Erforderliche Maßnahme: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 ; https://github.com/advisories/GHSA-5f37-gxvh-23v6 ; https://nvd.nist.gov/vuln/detail/CVE-2016-10033

Beschreibung

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Schwachstellentyp (CWE): CWE-88

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
joomla	joomla!	1.5.0 – ≤ 3.6.5
phpmailer project	phpmailer	< 5.2.18
wordpress	wordpress	≤ 4.7

Referenzen und Patches

http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html ExploitThird Party AdvisoryVDB Entry
https://www.drupal.org/psa-2016-004 Third Party Advisory
42221 exploitExploitThird Party AdvisoryVDB Entry
40969 exploitExploitThird Party AdvisoryVDB Entry
41962 exploitExploitThird Party AdvisoryVDB Entry
40968 exploitExploitPatchThird Party Advisory
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html ExploitPatchThird Party Advisory
https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 PatchVendor Advisory
20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] mailing-listBroken LinkThird Party AdvisoryVDB Entry
https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities PatchVendor Advisory
http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
40974 exploitExploitThird Party AdvisoryVDB Entry
40986 exploitExploitThird Party AdvisoryVDB Entry
40970 exploitExploitPatchThird Party Advisory
http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection ExploitThird Party Advisory
41996 exploitExploitThird Party AdvisoryVDB Entry
20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] mailing-listMailing ListPatchThird Party Advisory
95108 vdb-entryBroken LinkExploitThird Party Advisory
1037533 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html Third Party Advisory
42024 exploitExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-10033 US Government Resource

CPE-Treffer (NVD) (3)

cpe:2.3:a:phpmailer_project:phpmailer:*:*:*:*:*:*:*:* < 5.2.18
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* ≤ 4.7
cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:* ≥ 1.5.0 ≤ 3.6.5

CVSS-Score

9.8Kritisch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	9.8Kritisch
nvd	CVSS 3.1	9.8Kritisch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Kritisch
nvd	CVSS 2.0	7.5Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

99.71%

höher als 100 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2016-12-22
Veröffentlicht2016-12-30 22:00
Bei IP-DB eingegangen2026-10-24 23:30
In KEV aufgenommen2025-07-07
Zuletzt aktualisiert2026-06-17 03:38

Vergeben von (CNA): mitre
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Joomla!

7.0Hoch

CVE-2026-90915 vor 1 Monat

Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS

Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary d…

7.0Hoch

CVE-2026-92226 vor 1 Monat

Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS

Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.

5.9Mittel

CVE-2026-92224 vor 1 Monat

Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS

Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.

6.9Mittel

CVE-2026-90907 vor 1 Monat

Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS

Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites wit…

5.9Mittel

CVE-2026-90914 vor 1 Monat

Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS

Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts.

7.1Hoch

CVE-2026-92231 vor 1 Monat

Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS; Joomla! Project Joomla! Framework Filter package

Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however…