CVE-2006-7020: CRLF injection vulnerability in (1) include/inc_act/act_formmailer.php and possibly (2) sample_ext_php/mail...

Security readout for executives and security teams

CVE-2006-7020 affects old phpwcms form-mailer code. A remote attacker could abuse a spoofed Referer header to alter generated HTTP or mail headers and potentially send spam through the site. The sources do not provide a CVSS score, KEV listing, or clear current exploit evidence. Exposure is likely limited to legacy phpwcms deployments that still include the vulnerable form-mailer or sample mail script and allow public access to that functionality. Treat this as a legacy exposure cleanup item unless the organization still runs phpwcms form mailers publicly. If present, prioritize remediation because abuse could harm domain reputation and email deliverability. Mitigation focus: Inventory phpwcms installations and identify versions matching the affected ranges.; Check phpwcms vendor guidance and referenced advisories for the appropriate fixed release.; Disable or remove vulnerable form-mailer and sample mail scripts if they are unnecessary..

Prepared

Jun 29, 2026, 07:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.