CVE-2001-1100: Spencer Miles w3mail

High severity, CVSS 7.5. EPSS: 3.7% chance of exploitation in the next 30 days.

sendmessage.cgi in W3Mail 1.0.2, and possibly other CGI programs, allows remote attackers to execute arbitrary commands via shell metacharacters in any field of the 'Compose Message' page.

Affected products

Published 2001-10-07. Last modified 2026-06-16.