CVE-2006-7020: Oliver Georgi Phpwcms

High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days.

CRLF injection vulnerability in (1) include/inc_act/act_formmailer.php and possibly (2) sample_ext_php/mail_file_form.php in phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to modify HTTP headers and send spam e-mail via a spoofed HTTP Referer (HTTP_REFERER).

Affected products

• Oliver Georgi Phpwcms: up to and including 1.1_rc3; up to and including 1.2.5_dev

Published 2007-02-15. Last modified 2026-06-16.