CVE-2002-0986: The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which co...

Security readout for executives and security teams

Older PHP versions allowed unsafe characters in email parameters. If a website passed visitor-controlled data into PHP's mail() function, an attacker could alter email headers or message content and potentially abuse the server to send spam. Primarily legacy systems running PHP 4.x through 4.2.2, especially public web forms that call mail(). Modern supported PHP deployments should not be assumed affected from these sources. Treat as a legacy exposure cleanup issue. Prioritize if any internet-facing service still runs PHP 4.x or sends email from web forms, because compromise can damage mail reputation and trust. Mitigation focus: Inventory PHP versions and identify PHP 4.x through 4.2.2 systems.; Apply the relevant vendor advisory packages or vendor-recommended PHP update.; Retire unsupported PHP 4 deployments where feasible..

Prepared

Jun 30, 2026, 04:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.