CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Jul 28, 2025

High

CISA KEV

CVE-2016-10033

PHP—PHPMailer

PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Required Action

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 ; https://github.com/advisories/GHSA-5f37-gxvh-23v6 ; https://nvd.nist.gov/vuln/detail/CVE-2016-10033

Vulnerability Overview

Severity: High
CISA KEV: Yes
Ransomware: Unknown
Published: Jul 7, 2025
KEV Added: Jul 7, 2025
Due Date: Jul 28, 2025
Related Articles: 0

Vendor

PHP

PHPMailer