onyx

onyx --cves cve-2016-10033

CVE-2016-10033

N/AKEVNUCLEI ↗PHP
score
<0.1
cvss
—
epss
99.7%
published
—
kev added
2025-07-07
first seen

PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2025-07-07 — Added to CISA KEVK2026-10-21 (seen by) — Tracked by OnyxT2026-10-21 (seen by) — Nuclei template: WordPress PHPMailer < 5.2.18 - Remote Code ExecutionNscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 99.7%2026-09-23: epss 99.7%2026-09-24: epss 99.7%2026-09-25: epss 99.7%2026-09-26: epss 99.7%2026-09-27: epss 99.7%2026-09-28: epss 99.7%2026-09-29: epss 99.7%2026-09-30: epss 99.7%2026-10-01: epss 99.7%2026-10-02: epss 99.7%2026-10-03: epss 99.7%2026-10-04: epss 99.7%2026-10-05: epss 99.7%2026-10-06: epss 99.7%2026-10-07: epss 99.7%2026-10-08: epss 99.7%2026-10-09: epss 99.7%2026-10-10: epss 99.7%2026-10-11: epss 99.7%2026-10-12: epss 99.7%2026-10-13: epss 99.7%2026-10-14: epss 99.7%2026-10-15: epss 99.7%2026-10-16: epss 99.7%2026-10-18: epss 99.7%2026-10-19: epss 99.7%2026-10-20: epss 99.7%2026-10-21: epss 99.7%99.7%mentions/day0no mentions in 30 days2026-09-22today
  1. Added to CISA KEV
  2. Tracked by Onyx
  3. Nuclei template WordPress PHPMailer < 5.2.18 - Remote Code Execution

Nuclei template

A verified check exists — you can scan for this today, and so can everyone else.

template
WordPress PHPMailer < 5.2.18 - Remote Code Execution
severity
CRIT
first seen
nuclei -id CVE-2016-10033 -u https://target.example

Weaknesses

CWE-77 CWE-88

References 3