Servers and applications
CVE-2001-1246
PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
- Severity
- High 7.5
- Published
- 30 Jun 2001
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 14 Oct 2026
- Exploit chance
- 9.7% in the next 30 daysHigher than 95% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- Argument injection (CWE-88)
- Attack
- Over the network · No login needed
- Attacker can
- Read some data · Change some data · Slow it down
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
PHPServers and applications · cpe:a:php:php |
|