CVE-2002-1575: Mit Cgiemail

Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days.

cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline (%0a) characters in parameters such as "required-subject," which can be used to modify the CC, BCC, and other header fields in the generated email message.

Affected products

• Mit Cgiemail: version 1.6 only

Published 2004-03-03. Last modified 2026-06-16.