Risk Letters

Exploited vulnerability

CVE-2016-10033

TLP:CLEAR

PHPMailer Command Injection Vulnerability

PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Facts

  • Vendor: PHP
  • Product: PHPMailer
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 99.7 %
  • On CISA's Known Exploited Vulnerabilities list since: 7 July 2025
  • First known exploitation: 7 July 2025
  • CISA's deadline for US federal agencies: 28 July 2025
  • Weakness: CWE-77
  • First seen by Risk Letters: 7 July 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD