EIP-2026-112418

This exploit targets a remote file inclusion vulnerability in PHP Form Mail Script 2.3 and prior versions. It allows an attacker to execute arbitrary server-side script code by manipulating the 'script_root' parameter in 'inc/formmail.inc.php'.