Description
Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the Bugzilla_login cookie in post_bug.cgi, or (2) the who parameter in process_bug.cgi.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Frank van Vliet karin · perlremotecgi
https://www.exploit-db.com/exploits/19909
Scores
EPSS
0.0623
EPSS Percentile
90.9%
Details
Status
published
Products (4)
mozilla/bugzilla
2.4
mozilla/bugzilla
2.6
mozilla/bugzilla
2.8
mozilla/bugzilla
2.10
Published
Jun 27, 2001
Tracked Since
Feb 18, 2026