CVE-2000-0411
8%Chance of exploitation in the next 30 days (FIRST EPSS)
Not in KEVNo confirmed exploitation in CISA's catalog yet
What is it?
Matt Wright's FormMail CGI script allows remote attackers to obtain environmental variables via the env_report parameter.
Official description from NVD.
What happened
Researchers detected a resurgence in scans targeting vulnerable email CGI scripts on honeypots, similar to CVE-2000-0411 and related flaws. Attackers probe for test scripts like sendmail.php and testemail.php left behind during development, attempting to set arbitrary email headers or achieve code execution. Organizations should remove development test scripts and validate email form implementations.
From the Intel60 brief of Nov 4, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- InfoLegacy email scripts targeted by spammers in honeypot scansNov 4, 2026