CVE-2004-0259

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-11-23 · updated 2026-06-16

Description

The check_referer() function in Formmail.php 5.0 and earlier allows remote attackers to bypass access restrictions via an empty or spoofed HTTP Referer, as demonstrated using an application on the same web server that contains a cross-site scripting (XSS) issue.

Affected products

Joe Lumbroso Acks Formmail.Php: 2.0, 5.0

References

http://marc.info/?l=bugtraq&m=107619109629629&w=2
http://www.securityfocus.com/bid/9591
https://exchange.xforce.ibmcloud.com/vulnerabilities/15079
http://marc.info/?l=bugtraq&m=107619109629629&w=2
http://www.securityfocus.com/bid/9591
https://exchange.xforce.ibmcloud.com/vulnerabilities/15079

Get alerted when CVE-2004-0259 or the next vulnerability affects your stack