CVE-2001-1370: Phplib Team Phplib

High severity, CVSS 10.0. EPSS: 17.2% chance of exploitation in the next 30 days.

prepend.php3 in PHPLib before 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server, as seen in Horde 1.2.5 and earlier, IMP before 2.2.6, and other packages that use PHPLib.

Affected products

• Phplib Team Phplib: version 7.2 only; version 7.2.1 only; version 7.2b only; version 7.2c only

Published 2001-07-21. Last modified 2026-06-16.