CVE-2004-0259: The check_referer() function in Formmail.php 5.0 and earlier allows remote attackers to bypass access restr...

Security readout for executives and security teams

CVE-2004-0259 affects Formmail.php 5.0 and earlier. The script could trust the HTTP Referer header for access control, but that header can be empty or spoofed. For legacy public websites still using this script, restricted form actions may be reachable by remote attackers. Exposure is most likely on legacy internet-facing PHP sites that still deploy Formmail.php 5.0 or earlier, especially contact or upload form handlers. The source bundle does not identify a vendor CPE or maintained product lineage. Treat as a legacy exposure cleanup item unless asset discovery finds active public deployments. Prioritize removal or replacement on internet-facing sites because the control model relies on an untrustworthy browser header. Mitigation focus: Inventory web roots and repositories for Formmail.php 5.0 or earlier.; Check maintainer or vendor guidance for replacement, upgrade, or removal advice.; Do not rely on HTTP Referer as an access-control decision..

Prepared

Jun 30, 2026, 06:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.