VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2002· Updated Jun 16, 2026

CVE-2002-2331

CVE-2002-2331

Description

W3Mail 1.0.2 through 1.0.5 with server side scripting (SSI) enabled in the attachments directory does not properly restrict the types of files that can be uploaded as attachments, which allows remote attackers to execute arbitrary code by sending code in MIME attachments, then requesting the attachments.

Affected products

4
  • Cascadesoft/W3mail4 versions
    cpe:2.3:a:cascadesoft:w3mail:1.0.2:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:cascadesoft:w3mail:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:cascadesoft:w3mail:1.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:cascadesoft:w3mail:1.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:cascadesoft:w3mail:1.0.5:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.