CVE catalog
CVE-2000-0967
PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs
- Severity
- Critical · CVSS 10
AV:N/AC:L/Au:N/C:C/I:C/A:C - Published
- Dec 19, 2000
- Updated
- Sep 23, 2026
- EPSS
- 20.63% · Oct 22, 2026
Packages
No matching packages in this catalog.
Observed: Oct 23, 2026