CRITICALCVSS 9.8Actively exploited · CISA KEV since 2025-07-07Vulnerability
CVE-2016-10033
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Properties
- Vulnerability name
- PHPMailer Command Injection Vulnerability
- First seen
- 2025-10-21T23:55:47+00:00
- Cvss score
- 9.8
- Epss score
- 0.99714
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2025-07-28
- Euvd assigner
- mitre
- Retrieved at
- 2026-10-21T01:24:47+00:00
- Exploited euvd since
- 2025-07-07T00:00:00+00:00
- Src batch id
- epss_history-20261020T103617Z-728ddd
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Date added
- 2025-07-07
- Score
- 9.8
- Euvd base score version
- 3.1
- Fetched at
- 2026-10-20T10:36:20+00:00
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 9.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Vendor project
- PHP
Related Entities (6)
AFFECTS_PRODUCT (3)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
Explore deeper with Ninja Signal's threat intelligence graph