CVE-2000-0967: PHP

High severity, CVSS 10.0. EPSS: 20.6% chance of exploitation in the next 30 days.

PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.

Affected products

• PHP PHP: version 3.0 only; version 4.0 only

Published 2000-12-19. Last modified 2026-09-23.