CVE-2001-1100

HIGH 7.5CVE-2001-1100 · Published 07/10/2001 · updated 16/06/2026

In short

CVE-2001-1100 is a HIGH (CVSS 7.5) vulnerability affecting w3mail (spencer miles).
Chance of exploitation in the next 30 days (EPSS): 3.7%, higher than 89.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
w3mail spencer_miles	`= 1.0.2`	No fix yet

Description

sendmessage.cgi in W3Mail 1.0.2, and possibly other CGI programs, allows remote attackers to execute arbitrary commands via shell metacharacters in any field of the 'Compose Message' page.

References

securityfocus.com/archive/1/218921 · Exploit
securityfocus.com/bid/3673 · Vendor Advisory
w3mail.org/ChangeLog
exchange.xforce.ibmcloud.com/vulnerabilities/7230

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free