CVE-2000-0059

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

No affected versions have been published.

Timeline

Published: Jan 4, 2000
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2000

CVE-2000-00605.0Buffer overflow in aVirt Rover POP3 server 1.1 allows remote attackers to cause a denial of service via a long user name.CVE-2000-006110.0Internet Explorer 5 does not modify the security zone for a document that is being loaded into a window until after the document has been lo CVE-2000-006210.0The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.CVE-2000-00635.0cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to read arbitrary files by specifying the filename in a parameter CVE-2000-00645.0cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes sh CVE-2000-006510.0Buffer overflow in InetServ 3.0 allows remote attackers to execute commands via a long GET request.CVE-2000-00665.0WebSite Pro allows remote attackers to determine the real pathname of webdirectories via a malformed URL request.CVE-2000-00672.1CyberCash Merchant Connection Kit (MCK) allows local users to modify files via a symlink attack.CVE-2000-00687.5daynad program in Intel InBusiness E-mail Station does not require authentication, which allows remote attackers to modify its configuration CVE-2000-00692.1The recover program in Solstice Backup allows local users to restore sensitive files.CVE-2000-00707.2NtImpersonateClientOfPort local procedure call in Windows NT 4.0 allows local users to gain privileges, aka "Spoofed LPC Port Request."CVE-2000-00715.0IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensi