CVE-2005-0678: PHP remote file inclusion vulnerability in formmail.inc.php for Form Mail Script 2.3 and earlier allows rem...

Security readout for executives and security teams

This is an old PHP Form Mail Script flaw that can let a remote attacker make the application run attacker-controlled PHP. If an internet-facing site still runs Form Mail Script 2.3 or earlier, compromise could mean full control of that web application context. Exposure is likely limited to legacy PHP sites that still include Form Mail Script 2.3 or earlier, especially old contact-form deployments left in public web roots. Prioritize urgent remediation for any internet-facing instance. The technology is old, but the impact is severe where still deployed: remote PHP execution can lead to site takeover and data exposure. Mitigation focus: Identify any Form Mail Script 2.3 or earlier installations.; Check Stadtaus or trusted vendor guidance for upgrade or replacement options.; Remove or disable unused formmail.inc.php deployments..

Prepared

Jun 29, 2026, 23:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.