Back to the CVE list
CVE-2016-10033 CISA KEV · Actively exploited

phpmailer: Parameter injection via mail() function

CVSS score

6.8

EPSS probability

%99.7

Risk score

13.6

Published

9 y ago

OverviewPublic Exploits (20)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
blue-chocolates/CVE-2016-10033
GitHub

blue-chocolates/CVE-2016-10033

Public PoCSource updated: 24.07.2026 10:34:41
G
sealldeveloper/CVE-2016-10033-PoC
GitHub

A PoC of CVE-2016-10033 I made for PentesterLab

Public PoCSource updated: 25.04.2025 18:08:09
G
alexander47777/CVE-2016-10033
GitHub

alexander47777/CVE-2016-10033

Public PoCSource updated: 11.08.2025 13:09:42
G
Astrowmist/POC-CVE-2016-10033
GitHub

Proof Of Concept for the CVE-2016-10033 (PHPMailer)

Public PoCSource updated: 06.06.2024 11:56:40
G
ElnurBDa/CVE-2016-10033
GitHub

CVE-2016-10033 Wordpress 4.6 Exploit

Public PoCSource updated: 16.05.2024 18:56:50
G
opsxcq/exploit-CVE-2016-10033
GitHub

PHPMailer < 5.2.18 Remote Code Execution exploit and vulnerable container

Public PoCSource updated: 12.10.2026 13:28:57
G
CAOlvchonger/CVE-2016-10033
GitHub

wordpress docker

Public PoCSource updated: 18.11.2022 02:07:39
G
zeeshanbhattined/exploit-CVE-2016-10033
GitHub

PHPMailer < 5.2.18 Remote Code Execution

Public PoCSource updated: 05.08.2022 08:25:38
G
j4k0m/CVE-2016-10033
GitHub

Remote Code Execution vulnerability in PHPMailer.

Public PoCSource updated: 07.09.2021 21:09:02
G
cved-sources/cve-2016-10033
GitHub

cve-2016-10033

Public PoCSource updated: 15.04.2021 21:13:09
E
PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution
Exploit-DB

PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution

Exploit referenceSource updated: 21.06.2017 00:00:00
E
WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit)
Exploit-DB

WordPress Plugin PHPMailer 4.6 - Host Header Command Injection (Metasploit)

Exploit referenceSource updated: 17.05.2017 00:00:00
E
Vanilla Forums < 2.3 - Remote Code Execution
Exploit-DB

Vanilla Forums < 2.3 - Remote Code Execution

Exploit referenceSource updated: 11.05.2017 00:00:00
E
WordPress Core 4.6 - Remote Code Execution
Exploit-DB

WordPress Core 4.6 - Remote Code Execution

Exploit referenceSource updated: 03.05.2017 00:00:00
E
PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution
Exploit-DB

PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution

Exploit referenceSource updated: 02.01.2017 00:00:00
E
PHPMailer < 5.2.18 - Remote Code Execution
Exploit-DB

PHPMailer < 5.2.18 - Remote Code Execution

Exploit referenceSource updated: 29.12.2016 00:00:00
E
PHPMailer < 5.2.20 - Remote Code Execution
Exploit-DB

PHPMailer < 5.2.20 - Remote Code Execution

Exploit referenceSource updated: 27.12.2016 00:00:00
E
PHPMailer < 5.2.18 - Remote Code Execution
Exploit-DB

PHPMailer < 5.2.18 - Remote Code Execution

Exploit referenceSource updated: 26.12.2016 00:00:00
E
PHPMailer < 5.2.18 - Remote Code Execution
Exploit-DB

PHPMailer < 5.2.18 - Remote Code Execution

Exploit referenceSource updated: 25.12.2016 00:00:00
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-10033.yaml
Nuclei

Nuclei: WordPress PHPMailer < 5.2.18 - Remote Code Execution

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2016-10033"